Network Access, Visibility, and Enforcement

350-701 · 45 questions

• A hotel-style lobby network managed by Cisco ISE must give visitors internet-only access after they accept an acceptable-use policy. No employee should create accounts or approve anyone. Which guest access flow fits this requirement?
• A company using Cisco ISE requires that each visitor's guest account be created or approved by a front desk employee before the visitor can connect. The employee should only manage guests, not change ISE policy. Which approach meets this requirement?
• IP phones, printers and badge cameras on a campus cannot run an 802.1X supplicant. Cisco ISE must still place each type into the correct VLAN or apply the correct dACL automatically. Which ISE capability makes this possible?
• An employee wants to connect a personal phone to the corporate SSID. Security forbids a shared Wi-Fi password and wants each device to authenticate individually with credentials that can be revoked. Which Cisco ISE approach meets this?
• A Cisco ISE deployment must give full access only to users who are members of a specific Active Directory group, while other domain users get restricted access. Which configuration supports this decision?
• A corporate laptop passes 802.1X authentication through Cisco ISE, but policy says it must not receive full network access until its antivirus and patch level are confirmed. How should ISE enforce this?
• A contractor laptop authenticates to the network successfully, but its compliance check fails because disk encryption is disabled. Policy says the device must still be able to fix the problem itself. What authorization outcome should be returned?
• Self-service kiosks in a store run a fixed set of business applications. Security wants to ensure that no other executable can run on them, including malware that has never been seen before. Which control best meets this goal?
• The network team wants to block a peer-to-peer file-sharing application for all devices crossing the internet edge, including unmanaged devices that have no endpoint agent. The application changes ports dynamically. Which control fits best?
• A company already manages its mobile devices with an MDM platform that tracks encryption, jailbreak status and PIN enforcement. It wants Cisco ISE to grant network access based on that compliance without installing another agent. What should be configured?
• A previously unseen application keeps appearing on corporate endpoints. One team runs a blocklist of known-bad software, another runs an application allowlist. What happens to the unknown application under each model by default?
• A campus access port must authenticate laptops with 802.1X, but printers on the same port type have no supplicant. The engineer wants 802.1X tried first, then MAB if no EAP response arrives. What should be configured on the switch?
• A new engineer is mapping the 802.1X roles in a deployment where a laptop connects to a Catalyst switch port and Cisco ISE makes the access decision. Which mapping of supplicant, authenticator and authentication server is correct?
• A network printer authenticates with MAB through Cisco ISE. An attacker unplugs it and connects a laptop configured with the printer's MAC address to the same port. Which design limits the damage of this attack?
• A company is introducing 802.1X with Cisco ISE on 3,000 wired ports. Leadership says no user can be locked out during rollout while the team reviews which devices pass and fail authentication. Which deployment approach fits?
• Contractors who authenticate with 802.1X through Cisco ISE must reach only two application servers, while employees on the same switches keep normal access. The engineer wants the restriction applied per session from ISE. What should the contractor authorization profile return?
• An IP phone and a PC daisy-chained behind it share one switch port. Both must authenticate separately through Cisco ISE, with the phone placed in the voice VLAN and the PC in the data VLAN. Which host mode supports this?
• A laptop connects with 802.1X, Cisco ISE assigns a posture-pending profile, and the posture agent then reports the laptop compliant. The user must receive full access without unplugging or rebooting. What makes the new policy take effect?
• A Cisco XDR analyst confirms an endpoint is compromised and wants to quarantine it on the network immediately through Cisco ISE, without logging in to the switch. Which mechanism makes this possible?
• Cisco ISE shows that it sent CoA requests to a Catalyst access switch, but sessions on the switch never change and ISE reports no acknowledgment. RADIUS authentication itself works normally. What is the most likely cause?
• A new device first connects and Cisco ISE gives it a generic unknown-device authorization. Seconds later, profiling probes classify it as a badge-reader controller, which has its own authorization rule. How does the device receive the correct access?
• After a device is reprofiled, Cisco ISE must move it from VLAN 50 to VLAN 60. The device does not renew its DHCP lease on a reauthentication, so it keeps an address from the wrong subnet. Which CoA type should be used?
• An engineer is writing firewall rules between a Catalyst switch and Cisco ISE and must understand CoA traffic direction. Normal RADIUS authentication flows from the switch to ISE. Which statement describes how CoA messages flow?
• DNS logs show one internal host querying thousands of long, random-looking subdomains of a single unfamiliar domain, mostly TXT record lookups, at a steady rate. What is the most likely explanation, and which control addresses it?
• A network sensor shows a workstation sending ICMP echo requests to one external host every few seconds, with payloads much larger than usual and different content in each packet. Normal pings in the environment carry small fixed payloads. What does this most likely indicate?
• A database server uploads several gigabytes each night to a personal account on a public cloud storage service that the company does not use. The traffic is HTTPS to a reputable provider. Which control best detects and prevents this exfiltration path?
• An attacker exfiltrates data from a compromised host in HTTPS POSTs to a newly registered domain that mimics a SaaS vendor. The firewall allows the traffic because it is encrypted on port 443. Which combination best improves detection?
• Flow records show a workstation sending steady UDP 123 traffic to an unknown external server, with packet sizes far larger than normal time requests. Corporate devices are supposed to use two internal time servers. What is the best response?
• An employee who has resigned starts sending compressed archives of customer records from the corporate mailbox to a personal webmail address. Which control is designed to detect and stop this exfiltration path?
• A single phishing campaign produces separate alerts in Cisco Secure Firewall, Cisco Secure Endpoint and Cisco Security Email Threat Defense. Analysts triage them one at a time and miss that they are linked. What capability addresses this?
• A SOC already collects logs centrally and writes detection rules, but each confirmed alert still requires an analyst to run the same lookups and containment steps by hand. The team asks whether it needs a SIEM, a SOAR, or both. What fills the gap described?
• A server that normally exchanges a few megabytes daily with two internal databases suddenly starts connecting to dozens of internal hosts on SMB at night. No signature matches the traffic. Which detection approach is most likely to flag this?
• While reviewing a Cisco XDR incident, an analyst confirms a laptop is beaconing to a command-and-control domain and wants to contain it immediately from the incident view rather than opening each product console. What should the analyst use?
• A SOC manager argues that network telemetry is redundant because every corporate laptop runs EDR. The network also has printers, IP cameras, contractor devices and IoT sensors. What is the strongest argument for keeping network telemetry?
• Analysts in a SOC receive thousands of low-severity alerts per day and routinely miss the few that matter. Leadership wants fewer, higher-confidence items to investigate without turning off detections. Which approach addresses this?
• Cisco Duo administrators want to be told when a user authenticates in an unusual way, for example from a new country and a never-seen device shortly after a normal login elsewhere, so they can review it. Which Duo capability is designed for this?
• A company wants its finance applications reachable only from company-managed laptops, while personal devices can still reach the intranet portal. Users already authenticate with Cisco Duo MFA. Which Duo capability enforces the managed-device requirement?
• Security wants Cisco Duo to warn or block users at login if their laptop is running an out-of-date operating system or has its host firewall or disk encryption turned off. Which Duo capability provides this?
• A company using Cisco Duo wants login requirements to tighten automatically when context is risky, for example when users connect from countries where it has no staff or through anonymizing networks, while normal office logins stay simple. Which Duo feature should be configured?
• Users complain about logging in separately to a dozen SaaS applications, while security also wants identity threats such as dormant privileged accounts surfaced across identity providers. Which Cisco Duo combination addresses both needs?
• A SOC using Splunk Enterprise Security wants an alert when the same user fails authentication on several different systems within a short window and then succeeds on one of them. Which Splunk ES mechanism should produce this alert?
• Tier-one analysts handle dozens of reported phishing emails daily, each time extracting URLs and attachments, checking reputation, searching for other recipients and opening a ticket. The steps never change. Which Splunk capability addresses this?
• Splunk Enterprise Security raises dozens of separate low-severity notable events for one user each day, such as an odd login time, a new device and a rare process. Analysts dismiss them individually. Which approach surfaces the user only when combined activity becomes significant?
• Security leadership wants to see monthly trends in incident counts, mean time to respond and the top attack categories across the environment, without asking analysts to run searches each time. What should be built in Splunk?
• Analysts need to track each investigation from detection to closure, including ownership, status changes, notes, evidence and actions taken, so audits can reconstruct who did what. Which Splunk capability supports this?