SkillTestPro | CCNP Security 350-701 SCOR Practice Test 27

CCNP Security 350-701 SCOR Practice Test 27 (Hard) - 802.1X Authentication Roles and Deployment Modes

CISCO CCNP Security Exam Logo

1 / 10

Which three roles make up the standard 802.1X port-based authentication architecture?

Client, gateway, and DNS resolver

Primary, secondary, and tertiary controller

Sender, relay, and receiver

Root bridge, designated bridge, and blocked port

Supplicant, authenticator, and authentication server

Access point, controller, and wireless client only, with no wired equivalent

2 / 10

Which 802.1X role is typically played by the software component running on the endpoint device that initiates the authentication exchange with the network?

The policy administration point exclusively, with no endpoint role

The authentication server

The RADIUS proxy exclusively, with no endpoint role

The supplicant

The certificate revocation list distribution point exclusively

The authenticator

3 / 10

Which 802.1X role is typically played by the network switch or wireless LAN controller that controls the port and relays authentication traffic between the supplicant and the authentication server?

The certificate authority exclusively, with no port-control role

The authentication server

The DHCP server exclusively, with no port-control role

The supplicant

The authenticator

The DNS server exclusively, with no port-control role

4 / 10

Which 802.1X deployment mode allows a port to grant network access without requiring 802.1X authentication, instead relying on a device's MAC address as an implicit credential, commonly used for devices that cannot run a supplicant?

MAC Authentication Bypass (MAB)

EAP-FAST with protected access credentials

PEAP with MS-CHAPv2 inner method

Closed mode 802.1X with no fallback

EAP-TLS with mutual certificate authentication

WPA3-Enterprise with 802.1X and no MAC-based fallback

5 / 10

Which 802.1X port behavior mode allows limited network traffic (such as DHCP and DNS) before authentication completes, in contrast to a mode that blocks all traffic until authentication succeeds?

A mode that forces the port into an err-disabled state on first connection

Open mode (also called monitor mode when used for auditing prior to enforcement)

A mode that immediately blacklists the connecting device's MAC address

A mode that permanently disables the port until manually re-enabled by an administrator

A mode that requires physical console access before any traffic is permitted

Closed mode with no pre-authentication traffic allowed at all

6 / 10

Which 802.1X EAP method uses mutual certificate-based authentication between the supplicant and authentication server, generally considered one of the strongest available EAP methods?

Open authentication with no credential exchange

PAP

Telnet-based login authentication

WEP shared-key authentication

EAP-TLS

CHAP with a shared static passphrase only

7 / 10

Which 802.1X deployment consideration is most important when planning a phased rollout across an enterprise's existing wired access ports, to avoid disrupting legitimate users or devices during the transition?

Beginning with monitor/open mode to observe authentication results without enforcing access denial, before moving to closed/enforcement mode

Enabling closed mode enforcement on every port simultaneously on day one with no monitoring period, though this depends on which specific network access device and firmware version is in use

Removing all fallback mechanisms such as MAB before any testing occurs

Disabling all switch port logging during the rollout to reduce noise

Skipping any pilot phase and deploying directly to the entire production network

Rolling out only to the CEO's office first with no broader plan

8 / 10

Which scenario would most appropriately rely on MAC Authentication Bypass (MAB) rather than full 802.1X authentication?

A wireless client fully configured for WPA3-Enterprise with 802.1X

A user's smartphone with a properly configured 802.1X supplicant profile

A VPN client authenticating over an encrypted tunnel with no relevance to wired 802.1X

A corporate laptop running a fully 802.1X-capable operating system with a valid certificate

A network printer or IP camera that has no 802.1X supplicant capability

A server explicitly provisioned with EAP-TLS certificates for authentication

9 / 10

Which RADIUS attribute returned by ISE to the authenticator following successful 802.1X authentication would instruct the switch to place the endpoint into a specific VLAN?

The syslog server address attribute

RADIUS VLAN assignment attributes (Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID)

The SNMP community string attribute, a nuance that several deployment guides treat as a secondary consideration

The NTP server address attribute

The DNS server address attribute

The DHCP lease time attribute

10 / 10

Which combination of 802.1X design elements would provide the most robust and flexible authentication coverage across a mixed enterprise environment containing modern laptops, legacy printers, and IoT sensors?

802.1X enforcement alone with no MAB fallback for any device type

Closed mode enforced immediately on day one with no staged rollout or fallback

Device profiling alone with no authentication mechanism enforced at all

No authentication mechanism at all, relying solely on physical port security

MAB alone applied universally to every device including fully 802.1X-capable laptops, under the platform's default authorization policy before any custom rule is applied, which some environments handle differently depending on the identity source configured

802.1X with EAP-TLS or PEAP for capable devices, MAB as a fallback for non-supplicant devices, device profiling to apply appropriate policy, and a staged open-to-closed mode rollout

Your score is

The average score is 0%