350-701 Practice Question: Secure Network Access, Visibility and Enforcement
Exhibit
Refer to the exhibit. interface GigabitEthernet1/0/1 description User Access switchport access vlan 100 switchport mode access authentication port-control auto authentication periodic authentication timer reauthenticate 3600 dot1x pae authenticator dot1x timeout tx-period 3 dot1x max-reauth-req 2 mab ! !Global: aaa new-model aaa authentication dot1x default group radius aaa authorization network default group radius radius-server host 10.1.1.20 key cisco123
Refer to the exhibit. A switch port is configured for 802.1X with MAB. The switch has reached its maximum number of authentication sessions (platform limit). When a new device attempts to connect, what happens?
⚠ Common exam trap
Cisco often tests the misconception that MAB or 802.1X fallback mechanisms will automatically handle session exhaustion, when in reality the session limit is a hard resource constraint that blocks all new authentications until an existing session is released.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The new device is not authenticated and remains unauthorized
When the switch reaches its platform-specific limit for authentication sessions (e.g., 256 sessions on a Catalyst 3850), no new 802.1X or MAB sessions can be initiated. The new device remains in an unauthorized state (typically in the 'critical' or 'auth-fail' VLAN, or simply blocked) because the switch cannot allocate a new session context. There is no automatic fallback or CoA action to free a session; the port stays in the unauthorized state until an existing session expires or is manually cleared.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The new device is not authenticated and remains unauthorized
Why this is correct
If the platform limit is reached, the switch cannot create new sessions, so the port remains unauthorized for the new device.
- ✗
The new device is allowed to pass traffic due to fallback
Why it's wrong here
Fallback only applies if configured; even then, it would not bypass session limits.
- ✗
The switch sends a CoA to ISE to free up a session
Why it's wrong here
CoA is not automatically sent; the administrator must configure session limits and actions.
- ✗
The port is automatically shut down
Why it's wrong here
There is no automatic shutdown; the new device is simply not authenticated.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.