350-701 Practice Question: Secure Network Access, Visibility and Enforcement
Exhibit
Refer to the exhibit. ISE CLI output: ise/admin# show aaa auth method all | include AD AD_1: Active Directory (example.com) Status: Connected Last contact: 2 seconds ago Last error: None Domain Controllers: dc01.example.com (10.1.1.10), dc02.example.com (10.1.1.11) Is Allowed: True Users Authenticated: 0 ise/admin# show aaa auth method all | include LDAP LDAP_1: LDAP (10.2.2.20) Status: Connected Last contact: 10 minutes ago Last error: Timeout Users Authenticated: 0
Refer to the exhibit. An engineer configured ISE to use both Active Directory and LDAP for authentication. Users from Active Directory are unable to authenticate. What is the most likely reason?
⚠ Common exam trap
Cisco often tests the misconception that a disconnected identity store is the root cause, when in fact the authentication sequence order and reachability of the first store in the list is the critical factor that causes users from a secondary store to fail authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The LDAP identity store is unreachable and ISE is attempting LDAP before AD
When ISE is configured with both Active Directory and LDAP identity stores, the authentication sequence determines the order in which they are tried. If the sequence is set to 'LDAP then AD' and the LDAP server is unreachable, ISE will attempt LDAP first, fail (due to unreachability), and then proceed to AD. However, if the LDAP server is unreachable but the sequence is 'AD then LDAP', AD would be tried first and succeed for AD users. The most likely reason AD users fail is that the sequence is 'LDAP then AD' and LDAP is unreachable, causing ISE to attempt LDAP first and fail before ever reaching AD, or the sequence is misconfigured such that AD is not tried at all. This aligns with the exhibit's implication that LDAP is attempted before AD, and LDAP being unreachable blocks AD authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Active Directory users are not allowed in the policy
Why it's wrong here
The policy is not shown; the problem is likely the dead LDAP server.
- ✓
The LDAP identity store is unreachable and ISE is attempting LDAP before AD
Why this is correct
If LDAP is configured as the first authentication source, the timeout causes authentication to fail before AD is tried.
- ✗
The Active Directory identity store is disconnected
Why it's wrong here
The exhibit shows AD is connected.
- ✗
The authentication sequence is set to 'AD then LDAP'
Why it's wrong here
If AD was first, it would likely succeed. The exhibit suggests LDAP is failing.
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.