350-701 Practice Question: Secure Network Access, Visibility and Enforcement
Which THREE capabilities are provided by Cisco ISE's visibility services within the Secure Network Access domain? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Endpoint profiling and classification (including IoT)
Cisco ISE visibility services focus on identifying and profiling endpoints, managing guest access, and collecting contextual data. Option A (Endpoint profiling and classification, including IoT) is correct because ISE uses profiling probes to classify devices. Option D (Guest user registration and sponsor workflows) is correct as ISE provides a guest portal for registration and sponsor approval. Option E (Passive identity monitoring and contextual data collection) is correct as ISE can monitor network traffic passively via integrations like pxGrid to collect identity and context. Options B and C are incorrect: 802.1X authentication is an enforcement mechanism, not a visibility service, and Security Group Access (SGA) enforcement is a policy enforcement feature, not visibility.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Endpoint profiling and classification (including IoT)
Why this is correct
ISE profiles endpoints based on attributes like MAC OUI, DHCP options.
- ✗
802.1X authentication for wired and wireless
Why it's wrong here
This is an authentication mechanism, not visibility.
- ✗
Security group access control enforcement
Why it's wrong here
This is enforcement, not visibility.
- ✓
Guest user registration and sponsor workflows
Why this is correct
Guest management provides visibility into who is on the network.
- ✓
Passive identity monitoring and contextual data collection
Why this is correct
ISE collects context via network devices and pxGrid.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.