350-701 Practice Question: Secure Network Access, Visibility and Enforcement
Exhibit
Refer to the exhibit.
Switch# show authentication sessions interface GigabitEthernet1/0/10 details
Interface: GigabitEthernet1/0/10
MAC Address: aaaa.bbbb.cccc
IP Address: 192.168.10.55
Status: Authz Success
Domain: DATA
Oper host mode: multi-auth
Oper control dir: both
Authorized By: Authentication Server
Vlan Policy: 10
Session timeout: 3600s
Client List:
aaaa.bbbb.cccc: dot1x
EAP: PEAP, User-Name: jdoe
Result: PASS
SGT: 0
AudIT: NoneRefer to the exhibit. A user has successfully authenticated via 802.1X. However, the SGT (Security Group Tag) assigned is 0, which is the default untagged value. Which configuration change would most likely allow ISE to assign a non-zero SGT for this user?
⚠ Common exam trap
Cisco often tests the misconception that simply enabling 802.1X authentication or configuring RADIUS server details is sufficient to receive a non-zero SGT, when in fact the SGT must be explicitly defined in the ISE authorization profile using the Cisco AV pair 'cts:security-group-tag'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In ISE authorization profile, add Cisco AV pair 'cts:security-group-tag=15'
The SGT (Security Group Tag) is assigned by ISE via a RADIUS AV (Attribute-Value) pair during the 802.1X authorization phase. The Cisco AV pair 'cts:security-group-tag=15' explicitly instructs ISE to send SGT value 15 in the RADIUS Access-Accept message. Without this AV pair in the authorization profile, ISE defaults to SGT 0 (untrusted/unassigned), even if the user successfully authenticates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
In ISE authorization profile, add Cisco AV pair 'cts:security-group-tag=15'
Why this is correct
ISE must send the SGT as a RADIUS attribute in the Access-Accept. Currently, it is not sending any SGT, so SGT is 0.
- ✗
Enable 'cts manual' globally on the switch
Why it's wrong here
'cts' must be enabled for TrustSec to process SGTs, but the exhibit shows the switch is not configured for CTS at all. However, enabling 'cts' alone without ISE sending SGT will not assign a non-zero SGT.
- ✗
Ensure that the switch has a RADIUS server defined with 'radius-server host 10.1.1.1 auth-port 1645'
Why it's wrong here
The switch already communicates with the RADIUS server (ISE) as shown by successful authentication.
- ✗
Configure 'aaa authorization network default group radius' on the switch
Why it's wrong here
Authorization is already happening per the exhibit.
- ✗
Enable 'sgt caching' on the switch port
Why it's wrong here
SGT caching is not required for SGT assignment; it is used for propagation.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.