SkillTestPro | CCNP Security 350-701 SCOR Practice Test 26

CCNP Security 350-701 SCOR Practice Test 26 (Hard) - Cisco ISE Architecture and Policy Enforcement

CISCO CCNP Security Exam Logo

1 / 10

Which primary role does Cisco Identity Services Engine (ISE) play in an organization's network access security architecture?

Serving as the organization's primary email relay server

Managing the organization's physical badge access system

Providing DNS resolution for internal hostnames only

Functioning as a Layer 2 switch forwarding frames between VLANs, though this depends on which specific network access device and firmware version is in use

Hosting the corporate public-facing website

Acting as a centralized policy server for authentication, authorization, and accounting (AAA) decisions governing network access

2 / 10

Which ISE deployment role is responsible for making the actual policy evaluation and authorization decision when an endpoint attempts to authenticate to the network?

A standalone DNS server with no ISE integration

A standalone NTP server with no ISE integration

The primary Administration Node exclusively, with no runtime evaluation role

A standalone DHCP server with no ISE integration

The Monitoring Node exclusively, with no policy evaluation role

The Policy Service Node (PSN)

3 / 10

Which ISE persona is primarily responsible for storing long-term logging, reporting, and historical authentication data for troubleshooting and compliance purposes?

The Administration Node exclusively, with no logging role

The Monitoring and Troubleshooting (MnT) Node

A standalone NetFlow collector entirely separate from ISE

A standalone SNMP trap receiver entirely separate from ISE

A standalone syslog server entirely separate from ISE

The Policy Service Node exclusively, with no logging role

4 / 10

Which ISE component evaluates endpoint compliance factors, such as antivirus status and patch level, before granting or restricting network access?

802.1Q trunk native VLAN assignment, a nuance that several deployment guides treat as a secondary consideration

Posture assessment/compliance policy

DHCP relay agent configuration

OSPF area border configuration

BGP route reflector configuration

Spanning tree root bridge election

5 / 10

Which ISE feature automatically identifies the type of device connecting to the network (such as a printer, IP phone, or IoT sensor) based on observed traffic characteristics, allowing type-appropriate policy to be applied?

Device profiling

DHCP option 82 relay insertion with no profiling logic

OSPF hello packet exchange

802.1Q trunk negotiation

Spanning tree PortFast configuration

Static MAC address entry performed manually for every single device

6 / 10

Which ISE authorization result would place a non-compliant or unauthenticated device into a restricted network segment with only limited access, such as to a remediation portal, rather than granting full network access?

A policy result that disables logging for that device going forward

Full, unrestricted administrative access to every network segment

Automatic escalation of the device to domain administrator privileges

Immediate, permanent physical disconnection of the switch port with no remediation path

A policy result that grants access to every VLAN simultaneously with no restriction

A restricted/quarantine VLAN or downloadable ACL authorization result

7 / 10

Which ISE deployment consideration would drive an organization to deploy multiple distributed Policy Service Nodes across regional data centers rather than a single centralized node?

Ensuring only a single point of failure exists for authentication

Guaranteeing that no posture assessment is ever required

Reducing the total number of endpoints that can be supported network-wide

Eliminating the need for RADIUS communication with network access devices

Reducing authentication latency and providing redundancy for endpoints authenticating from geographically distributed locations

Eliminating the need for any policy configuration on the Administration Node, under the platform's default authorization policy before any custom rule is applied

8 / 10

Which ISE integration allows the platform to share contextual identity and device information (such as user identity, device type, and security group) with other security platforms in real time, such as a firewall or SIEM?

Cisco Discovery Protocol

pxGrid (Platform Exchange Grid)

Spanning Tree Protocol

Hot Standby Router Protocol

Dynamic Trunking Protocol

VLAN Trunking Protocol

9 / 10

Which ISE licensing/feature tier consideration determines whether advanced capabilities such as TrustSec segmentation and full posture assessment are available in a given deployment?

The specific ISE license tier purchased (such as Essentials, Advantage, or Premier)

The brand of network cable used to connect the appliance, which some environments handle differently depending on the identity source configured

The appliance's rack mounting height in the data center

The physical color of the ISE appliance chassis

The time zone configured on the appliance's clock

The number of ceiling tiles in the server room

10 / 10

Which combination of ISE architectural elements together provides comprehensive, scalable network access control for a large distributed enterprise?

Policy Service Nodes alone with no Administration Node for configuration management

A single Administration Node performing every persona's role simultaneously with no distribution or redundancy, but typically only once confirmed during the next scheduled reauthentication interval, a distinction that grows more important as the access layer continues to scale

Redundant Administration Nodes for policy management, distributed Policy Service Nodes for local authentication decisions, Monitoring Nodes for logging, and pxGrid integration for sharing context with other security platforms

Monitoring Nodes alone with no Policy Service Nodes to render authorization decisions

pxGrid integration alone with no underlying AAA policy service at all

A manually maintained spreadsheet of MAC addresses with no ISE deployment at all

Your score is

The average score is 0%