Courseiva

CCNA Network Access Visibility Questions

24 of 99 questions · Page 2/2 · Network Access Visibility topic · Answers revealed

Practice these questionsExam hubAll questions
76
Multi-Selectmedium

A Cisco TrustSec deployment is being implemented to enforce micro-segmentation. The security team needs to ensure that Security Group Tags (SGTs) are propagated across the network. Which THREE methods can be used to distribute SGT information in a TrustSec environment? (Choose three.)

Select 3 answers
A.SGT over SXP (SGT Exchange Protocol)
B.SGT over Cisco Discovery Protocol (CDP)
C.SGT over VXLAN
D.SGT inline tagging (in the Ethernet header)
E.SGT over MPLS
AnswersA, C, D

SXP is a standard protocol to propagate SGTs between network devices without inline tagging.

Why this answer

The correct methods are SGT over SXP (SGT Exchange Protocol), SGT over VXLAN, and SGT inline tagging in the Ethernet header. SGT over MPLS is not a standard TrustSec propagation method. SGT over CDP is not supported; CDP is used for device discovery, not SGT propagation.

Practice this question →
77
MCQeasy

A small business uses Cisco ISE to authenticate employees via Active Directory. The company has a single ISE node and two Catalyst 2960-X switches. Employees connect to the network and are successfully authenticated using 802.1X with PEAP. The business wants to provide guest wireless access using a separate SSID with a captive portal. The engineer configures a new WLAN on the WLC (Cisco 2504) pointing to the same ISE node. Guest users can associate to the WLAN and get an IP address, but when they open a browser, they do not see the captive portal page; instead, they get a 'Connection refused' error. The engineer verifies that the guest portal is enabled on ISE and the WLC is configured to use ISE for RADIUS. What is the most likely cause?

A.The ISE guest portal service is not running
B.The guest user's device does not have a valid DNS server
C.The WLC is not configured with the ISE portal IP address for redirection
D.The guest WLAN does not have a pre-authentication ACL
AnswerC

The WLC needs to know where to redirect HTTP traffic; without that, the captive portal cannot appear.

Why this answer

The captive portal requires the guest traffic to be redirected to ISE's portal service. Typically, this is done by the WLC redirecting HTTP traffic to the ISE IP. If the DNS resolution for the portal fails or the WLC does not know the portal address, the redirect fails.

Option C is correct because the WLC must be configured with the portal IP (or domain) for redirection. Option A would affect all authentication. Option B might be needed but without proper redirect, portal won't show.

Option D is irrelevant.

Practice this question →
78
MCQeasy

The ISE logs show 'Authentication failed - RADIUS attribute Calling-Station-ID is missing' for a wired client. What is the most likely cause?

A.The switch is not configured to include the calling-station-id in RADIUS requests.
B.The switch is configured with 'authentication mac-move deny'.
C.The switch port is configured as a trunk port.
D.The client's MAC address is not registered in ISE.
AnswerA

Correct. The switch must be configured to send the Calling-Station-ID (client MAC) in RADIUS Access-Requests. Without this attribute, ISE cannot identify the client and fails authentication.

Why this answer

The switch must be configured to include the Calling-Station-ID (MAC address) in RADIUS requests (e.g., with the 'access-session include-attributes' command). If this attribute is missing, ISE will fail authentication with the specific error. Option B is incorrect because 'authentication mac-move deny' controls MAC mobility, not attribute delivery.

Option C is incorrect because trunk ports can still support 802.1X; the port mode does not directly cause missing Calling-Station-ID. Option D is incorrect because if the MAC is not registered, ISE would return a different failure reason (e.g., 'Unknown client'), not a missing attribute.

Practice this question →
79
MCQmedium

A user connected to port Gi1/0/1 cannot access the network. Based on the output, what is the most likely cause?

A.The RADIUS server is unreachable
B.The client does not support 802.1X
C.The switch has a misconfigured AAA command
D.The port is in errdisable state
AnswerB

EAP-timeout indicates client not responding to EAP.

Why this answer

The 'Reason: EAP-timeout' indicates that the client did not respond to 802.1X EAP requests, which typically means the client does not support 802.1X or it is not enabled. Option A is incorrect because if the RADIUS server were unreachable, the switch would likely use a critical VLAN, but the reason is EAP-timeout from the client side. Option C is incorrect because AAA configuration would cause different errors.

Option D is incorrect because 'Errdisable' would show a different port state.

Practice this question →
80
MCQeasy

An administrator needs to ensure that only authorized hosts can connect to a switch port. The port is connected to a single PC. Which 802.1X host mode should be configured?

A.Single-Host
B.Multi-Domain
C.Multi-Auth
D.Multi-Host
AnswerA

Allows only one authenticated device.

Why this answer

The Single-Host mode (option A) is correct because it allows only one authenticated host per port, which matches the requirement of a single PC connected to the switch port. In this mode, the port is authorized only after a single supplicant successfully completes 802.1X authentication, and no other devices can gain network access through that port, ensuring strict access control.

Exam trap

Cisco often tests the distinction between Single-Host and Multi-Host modes, where the trap is that candidates confuse 'single PC' with allowing multiple hosts after one authentication (Multi-Host), forgetting that Multi-Host does not enforce per-host authentication.

How to eliminate wrong answers

Option B (Multi-Domain) is wrong because it allows two hosts (one voice domain and one data domain) to authenticate on the same port, which is unnecessary for a single PC and could permit unauthorized devices. Option C (Multi-Auth) is wrong because it allows multiple hosts to authenticate individually on the same port, but the requirement specifies only one PC, so this mode would permit more than one device. Option D (Multi-Host) is wrong because it allows any number of hosts after a single successful authentication, which would bypass per-host authorization and could let unauthorized devices connect without authentication.

Practice this question →
81
MCQeasy

A network administrator is troubleshooting an issue where users in the Sales VLAN cannot access the internet through the Cisco Firepower Threat Defense (FTD) device. The FTD is configured with a security policy that allows traffic from the Sales subnet to any destination. However, the traffic is being blocked. Which feature should the administrator check first to resolve the issue?

A.Identity policy
B.SSL decryption policy
C.Intrusion prevention policy
D.URL filtering policy
AnswerD

URL filtering can block traffic even if the security policy allows it.

Why this answer

URL filtering policy. Even though the security policy allows traffic from the Sales subnet to any destination, a URL filtering policy can block internet access by categorizing or matching the destination URLs. If the policy is set to block all URLs or a specific category (e.g., 'Uncategorized URLs'), traffic will be dropped before it reaches the internet, regardless of the allow rule in the access control policy.

Exam trap

The trap here is that candidates assume an 'Allow' rule in the access control policy guarantees traffic flow, but Cisco tests the understanding that subordinate policies (like URL filtering) can override the parent rule's action, causing traffic to be blocked despite a seemingly permissive policy.

How to eliminate wrong answers

Option A is wrong because Identity policy is used to map users to groups for authentication and authorization, not to block or allow internet traffic based on URL or destination; it does not directly block traffic that is already allowed by the security policy. Option B is wrong because SSL decryption policy controls whether encrypted traffic is decrypted for inspection, but it does not block traffic by itself; traffic can still flow even if decryption is disabled or bypassed. Option C is wrong because Intrusion prevention policy (IPS) inspects traffic for malicious patterns and can drop malicious packets, but it would not block all internet traffic from a subnet unless a specific signature triggered; it is not a blanket block for internet access.

Practice this question →
82
MCQeasy

Refer to the exhibit. A network administrator is troubleshooting a wired client that has successfully authenticated using MAB. However, the client is unable to access resources beyond the local subnet. What is the most likely cause?

A.The client's IP address is from a DHCP scope that does not include a default gateway.
B.The VLAN policy is incorrect; the client should be in VLAN 20.
C.The switch is not configured for inter-VLAN routing.
D.The authorization policy is missing a downloadable ACL (dACL) to allow traffic.
AnswerD

Without a dACL, the switch may default to deny all traffic beyond the local subnet.

Why this answer

The authorization policy 'Permit_Access' likely does not include a downloadable ACL (dACL), which is required on the switch to allow traffic beyond the local subnet. Without a dACL, the switch defaults to denying inter-subnet traffic. Option A is incorrect because the DHCP scope may include a default gateway, but the issue is about traffic filtering, not IP assignment.

Option B is incorrect because VLAN 10 assignment is correct; the problem is the lack of a dACL to permit routing. Option C is incorrect because inter-VLAN routing is configured on the router or Layer 3 switch, but the switchport itself needs a dACL to allow traffic from the client.

Practice this question →
83
MCQmedium

A network engineer notices that some Windows 10 clients fail to authenticate via 802.1X after a recent OS update. The supplicant shows 'EAPOL-Start' but never receives an EAP-Request/Identity. The switch port is configured with 'authentication port-control auto' and 'dot1x pae authenticator'. What is the most likely cause?

A.The switch port is configured as a trunk port
B.The switch has 'aaa authentication dot1x default none' globally
C.The switch port is configured with 'authentication order mab dot1x'
D.The switch is configured with 'snmp-server community' which disables 802.1X
AnswerA

802.1X is not supported on trunk ports by default. The switch will not respond to EAPOL-Start on trunk ports.

Why this answer

The most likely cause is that the switch port is configured as a trunk port. 802.1X authentication is designed for access ports, not trunk ports. On a trunk port, the switch does not process EAPOL frames correctly because the port is expected to carry multiple VLANs and the switch's 802.1X state machine does not initiate the authentication process. As a result, the supplicant sends EAPOL-Start but the switch never responds with an EAP-Request/Identity, leading to authentication failure.

Exam trap

Cisco often tests the misconception that 802.1X can work on any port type, but the trap here is that 802.1X is only supported on access ports, and trunk ports will silently ignore EAPOL-Start frames.

How to eliminate wrong answers

Option B is wrong because 'aaa authentication dot1x default none' globally disables 802.1X authentication, which would prevent any EAPOL exchange entirely, but the supplicant is still sending EAPOL-Start, indicating that 802.1X is not globally disabled. Option C is wrong because 'authentication order mab dot1x' only changes the fallback order (MAB before 802.1X), but it does not prevent the switch from sending an EAP-Request/Identity; the switch would still attempt 802.1X first unless MAB succeeds. Option D is wrong because 'snmp-server community' does not disable 802.1X; SNMP configuration is unrelated to the EAPOL authentication process.

Practice this question →
84
Multi-Selectmedium

Which THREE are characteristics of Cisco ISE profiler service?

Select 3 answers
A.It can determine the endpoint operating system based on MAC OUI and DHCP fingerprints
B.It uses a combination of active and passive probes to identify endpoint attributes
C.It can provide attributes used in authorization policy conditions
D.It performs posture compliance checking on endpoints
E.It requires the installation of an ISE agent on all endpoints
AnswersA, B, C

Profiling uses these attributes to identify OS.

Why this answer

Cisco ISE's profiler service uses the MAC OUI (Organizationally Unique Identifier) to identify the hardware vendor, and DHCP fingerprints (specific option ordering in DHCP requests) to determine the exact operating system or device type. This passive profiling technique allows ISE to classify endpoints without requiring any agent installation.

Exam trap

Cisco often tests the distinction between the profiler service (attribute discovery) and the posture service (compliance checking), so candidates mistakenly attribute posture functions to the profiler.

Practice this question →
85
MCQhard

An engineer notices that the 'show authentication sessions' command on a switch shows a session in 'CRITICAL' state. What does this indicate?

A.The host is being authenticated via MAB
B.The authentication server is unreachable and the port is using the critical VLAN
C.The port is administratively down
D.The authentication attempt was rejected by the RADIUS server
AnswerB

CRITICAL state indicates critical fallback.

Why this answer

The 'CRITICAL' state in 'show authentication sessions' indicates that the switch port has lost connectivity to the authentication server (RADIUS) and has fallen back to the configured critical VLAN. This is a failover mechanism defined in IEEE 802.1X and Cisco's critical-auth feature, where the port is placed into a pre-configured VLAN to maintain network access for the host despite the server being unreachable.

Exam trap

Cisco often tests the distinction between 'CRITICAL' (server unreachable) and 'AUTH_FAILED' (server reachable but rejects the host), so candidates mistakenly choose the rejected authentication option when they see 'CRITICAL'.

How to eliminate wrong answers

Option A is wrong because MAB (MAC Authentication Bypass) is an authentication method, not a state; a session in CRITICAL state means the authentication server is unreachable, not that MAB is being used. Option C is wrong because an administratively down port would show a state like 'DOWN' or 'NOT RUNNING', not 'CRITICAL', which specifically relates to authentication server reachability. Option D is wrong because a rejected authentication attempt by the RADIUS server would result in a state like 'AUTH_FAILED' or 'UNAUTHORIZED', not 'CRITICAL', which is reserved for server unreachability scenarios.

Practice this question →
86
MCQmedium

A large enterprise uses Cisco ISE with pxGrid to share context with Firepower for threat containment. When a Firepower detects an infected endpoint, it triggers a pxGrid quarantine action that changes the endpoint's authorization profile. The engineer observes that the quarantine is applied, but after the Firepower clears the threat, the endpoint does not regain its original access. What is the most likely reason?

A.Firepower failed to send the clearance message to ISE
B.The ISE session is not forced to reauthenticate after quarantine release
C.The network access device does not support CoA
D.ISE authorization policy is not ordered correctly
AnswerB

Correct. The quarantine action changes the authorization profile, but after clearance, the session is not forced to reauthenticate, so the endpoint remains in quarantine.

Why this answer

When Firepower clears a threat and sends a clearance message to ISE via pxGrid, ISE may update the endpoint's authorization policy but does not automatically force the existing session to reauthenticate. The endpoint remains in the quarantine state because the network access device (NAD) still has the old session attributes. To restore original access, a Change of Authorization (CoA) must be sent to the NAD to trigger reauthentication.

Option B correctly identifies that the session is not forced to reauthenticate after quarantine release. Option A is incorrect because Firepower does send the clearance message. Option C is incorrect because the NAD accepted the quarantine CoA, indicating CoA support.

Option D is incorrect because the authorization policy order is not the issue; the problem is the lack of reauthentication.

Practice this question →
87
Multi-Selectmedium

Which TWO conditions must be met for a Cisco switch to initiate 802.1X authentication? (Choose two.)

Select 2 answers
A.The switch port is configured with 'authentication port-control auto'.
B.The switch port is configured with 'switchport mode access'.
C.The endpoint has a 802.1X supplicant enabled.
D.The switch has a VLAN configured for guest access.
E.The switch has a reachable RADIUS server configured.
AnswersA, E

This command enables 802.1X on the port.

Why this answer

The 'authentication port-control auto' command places the switch port in 802.1X authentication mode, allowing it to initiate the authentication process when a new endpoint connects. Without this configuration, the port remains in a force-authorized state and will not trigger 802.1X exchanges.

Exam trap

Cisco often tests the misconception that the endpoint must have a supplicant enabled for the switch to initiate 802.1X, but in reality the switch initiates authentication regardless, and the supplicant is only needed for the endpoint to respond.

Practice this question →
88
MCQhard

An engineer is deploying Cisco ISE for guest access. The guest portal uses a self-provisioned username and password. To ensure secure credential transmission, which protocol should be enforced on the portal?

A.DNSSEC
B.RADIUS over TLS
C.HTTPS with a valid certificate
D.HTTP with redirect to captive portal
AnswerC

Encrypts credentials between client and portal.

Why this answer

HTTPS with a valid certificate ensures that the username and password submitted by the guest are encrypted in transit between the browser and the Cisco ISE portal. This prevents man-in-the-middle attacks and credential sniffing, which is critical for a self-provisioned guest portal where users create their own credentials over an untrusted network.

Exam trap

Cisco often tests the distinction between securing the control plane (RADIUS/TLS) versus securing the user-facing portal (HTTPS), leading candidates to confuse RADIUS over TLS with web encryption.

How to eliminate wrong answers

Option A is wrong because DNSSEC is a protocol for authenticating DNS responses, not for securing HTTP traffic or credential transmission on a web portal. Option B is wrong because RADIUS over TLS (RadSec) secures communication between ISE and network devices (e.g., switches, WLCs), not between the end-user's browser and the guest portal. Option D is wrong because HTTP with redirect to captive portal transmits credentials in cleartext before any redirection occurs, exposing them to interception; the redirect itself does not provide encryption.

Practice this question →
89
MCQeasy

A network administrator wants to centrally manage and enforce access policies for wired and wireless users. Which Cisco product provides this functionality?

A.Cisco Identity Services Engine (ISE)
B.Cisco Prime Infrastructure
C.Cisco Adaptive Security Appliance (ASA)
D.Cisco Wireless LAN Controller (WLC)
AnswerA

Central policy engine for network access.

Why this answer

Cisco Identity Services Engine (ISE) is the correct answer because it provides centralized policy management for both wired and wireless users through a unified, context-aware platform. ISE uses 802.1X, MAC Authentication Bypass (MAB), and posture assessment to enforce access policies based on user identity, device type, and location, integrating with network devices via RADIUS (RFC 2865) and TACACS+ for authentication, authorization, and accounting (AAA).

Exam trap

Cisco often tests the distinction between management/monitoring tools (Prime Infrastructure) and policy enforcement engines (ISE), leading candidates to confuse Prime's visibility features with ISE's centralized policy control.

How to eliminate wrong answers

Option B (Cisco Prime Infrastructure) is wrong because it is primarily a network management and monitoring tool for wired and wireless infrastructure, not a policy enforcement engine; it lacks the AAA and policy decision point capabilities of ISE. Option C (Cisco Adaptive Security Appliance (ASA)) is wrong because it is a firewall and VPN concentrator focused on perimeter security and traffic inspection, not centralized user access policy management for wired/wireless endpoints. Option D (Cisco Wireless LAN Controller (WLC)) is wrong because it manages wireless access points and client roaming but relies on an external AAA server like ISE for policy enforcement; it cannot centrally manage policies across both wired and wireless domains independently.

Practice this question →
90
Multi-Selecteasy

Which TWO are valid methods for determining the SGT (Security Group Tag) assigned to an endpoint in a TrustSec deployment?

Select 2 answers
A.DNS resolution of the endpoint hostname
B.Static assignment on the network access device (switch) using the 'cts role-based sgt' command
C.The IP address of the endpoint
D.DHCP Option 141
E.Dynamic assignment from ISE based on authentication or authorization policy
AnswersB, E

The switch can be configured with a static SGT per port or per VLAN.

Why this answer

The 'cts role-based sgt' command on a network access device (switch) statically assigns an SGT to an endpoint based on its IP address or MAC address. Option E is correct because ISE can dynamically assign an SGT to an endpoint as part of an authorization policy during authentication, using RADIUS attributes like cisco-av-pair=CTS:SGT=value.

Exam trap

Cisco often tests the distinction between how an SGT is assigned to an endpoint (static on switch or dynamic from ISE) versus how an endpoint learns its own SGT (DHCP Option 141), leading candidates to incorrectly select DHCP Option 141 as a method for the network to determine the SGT.

Practice this question →
91
MCQmedium

A university is implementing 802.1X for student wireless networks using Cisco Wireless LAN Controllers (WLCs) and ISE. Students connect with their personal devices using PEAP-MSCHAPv2. During heavy usage, some students report authentication failures and sporadic disconnections. The network team examines the ISE live logs and sees many 'Authentication failed' entries with reason 'Internal error - unable to find a suitable proxy target'. The team has configured two ISE nodes as authentication proxies for the wireless subnets. What is the most likely cause of this issue?

A.The WLC is not configured to use the ISE proxy nodes as RADIUS servers
B.The RADIUS shared secret is mismatched between WLC and ISE
C.ISE node CPU is overloaded due to high authentication load
D.The proxy target rules in ISE do not match the WLC's NAS-IP-Address
AnswerD

Proxy target rules must include the NAS-IP-Address of the WLC to forward requests to the appropriate authentication node.

Why this answer

The error 'unable to find a suitable proxy target' indicates that the ISE node cannot determine which proxy to use for the authentication request, often due to proxy target rules not matching the incoming request attributes like NAS-IP-Address. Option D is correct because if the proxy target rules are missing or incorrect, ISE cannot forward the request. Option A would cause different errors.

Option B might cause performance but not internal error. Option C would cause connection errors, not proxy target errors.

Practice this question →
92
MCQmedium

Refer to the exhibit. An engineer configures this interface for 802.1X. Users report that after successful authentication, they are forced to reauthenticate every hour even though the authentication session is still active. What configuration change should be made to prevent reauthentication unless triggered by a change?

A.Increase 'dot1x timeout tx-period' to 60.
B.Change 'authentication timer reauthenticate' to 0.
C.Remove 'authentication periodic'.
D.Add 'authentication event server dead action authorize'.
AnswerC

Removing this command disables periodic reauthentication.

Why this answer

The 'authentication periodic' command enables periodic reauthentication. Removing it with 'no authentication periodic' stops automatic reauthentication, preventing the hourly reauthentication. Option A is incorrect because increasing 'dot1x timeout tx-period' only affects the timeout for initial EAP over LAN (EAPoL) transmissions, not reauthentication intervals.

Option B is incorrect because setting 'authentication timer reauthenticate' to 0 would disable periodic reauthentication, but the proper fix is to remove the 'authentication periodic' command to allow reauthentication only on change. Option D is incorrect because 'authentication event server dead action authorize' configures behavior when the RADIUS server is unavailable, which is unrelated to periodic reauthentication.

Practice this question →
93
MCQmedium

Refer to the exhibit. A user has successfully authenticated via 802.1X. However, the SGT (Security Group Tag) assigned is 0, which is the default untagged value. Which configuration change would most likely allow ISE to assign a non-zero SGT for this user?

A.In ISE authorization profile, add Cisco AV pair 'cts:security-group-tag=15'
B.Enable 'cts manual' globally on the switch
C.Ensure that the switch has a RADIUS server defined with 'radius-server host 10.1.1.1 auth-port 1645'
D.Configure 'aaa authorization network default group radius' on the switch
E.Enable 'sgt caching' on the switch port
AnswerA

ISE must send the SGT as a RADIUS attribute in the Access-Accept. Currently, it is not sending any SGT, so SGT is 0.

Why this answer

The SGT (Security Group Tag) is assigned by ISE via a RADIUS AV (Attribute-Value) pair during the 802.1X authorization phase. The Cisco AV pair 'cts:security-group-tag=15' explicitly instructs ISE to send SGT value 15 in the RADIUS Access-Accept message. Without this AV pair in the authorization profile, ISE defaults to SGT 0 (untrusted/unassigned), even if the user successfully authenticates.

Exam trap

Cisco often tests the misconception that simply enabling 802.1X authentication or configuring RADIUS server details is sufficient to receive a non-zero SGT, when in fact the SGT must be explicitly defined in the ISE authorization profile using the Cisco AV pair 'cts:security-group-tag'.

How to eliminate wrong answers

Option B is wrong because 'cts manual' globally on the switch enables manual SGT assignment on the switch itself, but it does not cause ISE to send a non-zero SGT via RADIUS; manual mode bypasses ISE’s dynamic SGT assignment. Option C is wrong because defining a RADIUS server with 'radius-server host 10.1.1.1 auth-port 1645' is a basic connectivity requirement for 802.1X, but it does not influence the SGT value ISE assigns; the user already authenticated, so RADIUS server reachability is not the issue. Option D is wrong because 'aaa authorization network default group radius' enables RADIUS-based authorization for network access, but it does not configure ISE to send a specific SGT; the authorization profile on ISE must include the CTS AV pair.

Option E is wrong because 'sgt caching' on the switch port is used to store and reuse SGTs learned from other sources (e.g., from a trusted switch), but it does not cause ISE to assign a non-zero SGT; the SGT must first be assigned via RADIUS.

Practice this question →
94
Multi-Selectmedium

An administrator is configuring 802.1X on a switch port for both an IP phone and a PC. Which two commands should be configured to support this scenario? (Choose two)

Select 2 answers
A.authentication host-mode multi-domain
B.dot1x pae authenticator
C.authentication violation restrict
D.authentication port-control auto
E.authentication host-mode multi-auth
AnswersA, D

Allows one voice and one data device.

Why this answer

The `authentication host-mode multi-domain` command allows one device in the voice domain (IP phone) and one device in the data domain (PC) to authenticate on the same switch port. This is the standard Cisco configuration for a phone-PC daisy-chain topology, where the phone acts as a bridge and the switch must distinguish between the two devices using separate VLANs (voice and data).

Exam trap

Cisco often tests the distinction between `multi-domain` and `multi-auth`; the trap here is that candidates mistakenly choose `multi-auth` thinking it supports multiple devices, but it does not enforce the separate voice and data domains needed for a phone and PC.

Practice this question →
95
MCQeasy

A network engineer is configuring 802.1X on a Cisco switch for wired clients. After configuration, some clients fail authentication. The engineer notices that the clients are not sending any EAP packets. What is the most likely cause?

A.The switch port is configured with access VLAN instead of voice VLAN.
B.The RADIUS server is unreachable.
C.The clients do not have an 802.1X supplicant enabled.
D.The switch port is configured with 'authentication port-control auto'.
AnswerC

Without a supplicant, clients cannot initiate EAP.

Why this answer

If no EAP packets are sent, the client likely does not have an 802.1X supplicant enabled. Option A is incorrect because access VLAN assignment does not affect EAP transmission. Option B is incorrect because 'authentication port-control auto' is the correct command to enable 802.1X.

Option D is incorrect because if the RADIUS server were unreachable, the switch would still see EAP packets from the client.

Practice this question →
96
MCQhard

A financial company is deploying Cisco ISE with TrustSec to enforce segmentation between application tiers (web, app, DB). They have a Cisco Catalyst 9500 as the core, and Catalyst 9300s as access switches. The SXP is configured between ISE and core switch, and the core switch propagates SGTs to access switches via SGT inline tagging on trunk ports. The engineer has configured SGTs for web (SGT=2), app (SGT=3), DB (SGT=4). However, when testing from a web server (IP 10.1.1.10, SGT=2) to an app server (IP 10.1.2.20, SGT=3), the app server sees the traffic without SGT in the packet, so the access switch cannot enforce policy. The engineer checks 'show cts role-based sgt-map' on the core and sees the mapping for 10.1.1.10 -> 2. What is the most likely issue?

A.The ISE policy does not allow the traffic from web to app
B.The access switch does not have the security group ACL configured
C.The trunk between core and access is not configured for SGT inline tagging
D.The SXP connection between ISE and core is not established
AnswerC

Without 'cts manual' or 'trust sec' on the trunk, the core switch will not insert the SGT into packets going to the access switch.

Why this answer

The core switch correctly maps IP 10.1.1.10 to SGT 2, as shown by 'show cts role-based sgt-map'. However, the access switch receives traffic without the SGT, meaning the SGT is not being propagated across the trunk. For SGT inline tagging to work, the trunk between core and access must have 'cts manual' enabled under the interface configuration.

Without this, the SGT is stripped from the packet. Option C is correct because the missing 'cts manual' on the trunk prevents the access switch from seeing the SGT tag. Option A is incorrect because ISE policy controls authorization, not packet tagging.

Option B is incorrect; the access switch lacking a security group ACL would not prevent the SGT from being present in the packet. Option D is incorrect; the SXP connection between ISE and core is functional since the core has the correct SGT mapping.

Practice this question →
97
MCQhard

An endpoint with MAC 0011.2233.4455 and user 'guest' authenticates but fails. However, the device is not assigned to quarantine. Which policy condition is most likely responsible for the unexpected behavior?

A.The authentication failure overrides authorization
B.The quarantine VLAN is not configured on the switch
C.The device is compliant and the device type is in the allowed list
D.The device is authenticated via MAB, bypassing posture
AnswerC

Condition false, so quarantine not applied.

Why this answer

The condition requires either 'EndPointCompliant EQUALS No' OR device type not in the list. If the device is compliant (posture passed) and the device type is in the list, the condition is false, so the quarantine rule is not applied, and a default permit rule might apply instead. Option A is incorrect because authentication failure would show 'Failed' and not reach authorization.

Option B is incorrect because MAB is not in use here. Option D is incorrect because if the device were in quarantine, it would have been assigned.

Practice this question →
98
MCQhard

An engineer is troubleshooting a Cisco ISE deployment where some endpoints are not being profiled correctly. The administrator notices that the endpoints are not sending DHCP requests. Which profiling probe should be primarily used to identify these endpoints?

A.NetFlow probe
B.DHCP probe
C.HTTP probe
D.DNS probe
AnswerA

NetFlow probe analyzes traffic flows and can profile endpoints based on IP and port information.

Why this answer

(NetFlow probe) because when endpoints do not send DHCP requests, the DHCP probe cannot collect any data. The NetFlow probe analyzes network traffic flows to identify endpoints based on IP addresses, ports, and protocols, even without DHCP activity. This allows Cisco ISE to profile endpoints by observing their communication patterns, such as HTTP or DNS traffic, which still occur even if DHCP is not used.

Exam trap

Cisco often tests the misconception that DHCP is the only way to profile endpoints, leading candidates to choose the DHCP probe, but the trap here is recognizing that NetFlow provides visibility even when DHCP traffic is absent.

How to eliminate wrong answers

Option B (DHCP probe) is wrong because it relies on DHCP requests and acknowledgments; if endpoints are not sending DHCP requests, this probe will not capture any data to profile them. Option C (HTTP probe) is wrong because it only identifies endpoints that generate HTTP traffic, which may not be present for all devices, and it is not the primary probe for endpoints lacking DHCP activity. Option D (DNS probe) is wrong because it depends on DNS queries, which may not be sent by all endpoints, and it is not the primary method when DHCP is absent.

Practice this question →
99
MCQeasy

Which protocol does Cisco ISE use to communicate with the pxGrid controller for sharing contextual data?

A.JSON-RPC over certificate-based TLS
B.REST API over HTTPS
C.TACACS+
D.RADIUS
AnswerA

pxGrid uses JSON-RPC over TLS with mutual certificate authentication.

Why this answer

Cisco ISE uses the JSON-RPC protocol over certificate-based TLS to communicate with the pxGrid controller for sharing contextual data. This ensures encrypted, authenticated, and structured messaging between ISE and other pxGrid-enabled services, such as Cisco Threat Response or third-party integrations.

Exam trap

Cisco often tests the distinction between pxGrid communication (JSON-RPC over TLS) and other ISE APIs (REST over HTTPS), leading candidates to mistakenly choose REST API because they associate HTTPS with secure data exchange.

How to eliminate wrong answers

Option B is wrong because REST API over HTTPS is used for northbound API calls (e.g., external systems querying ISE), not for pxGrid controller communication, which requires a persistent, bidirectional messaging protocol. Option C is wrong because TACACS+ is a legacy AAA protocol for device administration (authorization and accounting), not for real-time contextual data sharing via pxGrid. Option D is wrong because RADIUS is used for network access authentication, authorization, and accounting, and does not support the pub/sub or topic-based messaging required by pxGrid.

Practice this question →
← PreviousPage 2 of 2 · 99 questions total

Ready to test yourself?

Try a timed practice session using only Network Access Visibility questions.

Start 20-question session