SkillTestPro | CCNP Security 350-701 SCOR Practice Test 30

CCNP Security 350-701 SCOR Practice Test 30 (Hard) - Network Access Visibility and Enforcement - MAB, Profiling, and Posture

CISCO CCNP Security Exam Logo

1 / 10

Which combination of ISE mechanisms together provides visibility into exactly what type of device is connecting to a switch port, even before that device successfully authenticates?

Relying solely on the building floor plan showing furniture layout

Relying solely on the switch port's physical label written by hand

Relying solely on the device's paint color or physical case design

Device profiling based on DHCP, HTTP, and other observed traffic characteristics, correlated against known device profiles

Relying solely on the purchase order record from procurement

Waiting for the helpdesk to manually call and ask the user what device they are using, a distinction that grows more important as the access layer continues to scale

2 / 10

Which enforcement mechanism allows ISE to change a previously granted network access level for an endpoint mid-session, such as moving a device from full access to a quarantine VLAN after a posture failure is detected?

A DHCP lease renewal event with no security-driven trigger

A manually issued 'shutdown' command typed by an administrator at the console for every event

A DNS TTL expiration event

A physical technician walking to the switch and unplugging the cable

A scheduled nightly batch job that reviews and adjusts access once every 24 hours

RADIUS Change of Authorization (CoA)

3 / 10

Which posture assessment outcome would trigger a network access policy change for an endpoint found to be running an out-of-date antivirus signature file?

The endpoint's posture status is simply ignored with no policy action taken

The endpoint is immediately granted full administrative access to compensate

The endpoint's antivirus software is automatically uninstalled entirely

The endpoint is granted access to every other endpoint's shared files as a workaround

The endpoint is marked non-compliant and redirected to a remediation network segment until the antivirus signatures are updated

The endpoint is granted permanent, unconditional network access regardless of future compliance

4 / 10

Which visibility gap would most likely remain if an organization deployed 802.1X and MAB for wired access control but never enabled device profiling or posture assessment?

The organization would automatically gain full NetFlow visibility with no additional configuration

The organization would know a device successfully authenticated, but would have limited insight into the device's type, risk level, or security compliance state

The organization would automatically gain full endpoint antivirus telemetry with no additional configuration, though this depends on which specific network access device and firmware version is in use

The organization would lose the ability to authenticate any device whatsoever

The organization would be unable to assign any VLAN to any device

There would be no visibility gap at all, since authentication alone provides complete context

5 / 10

Which reporting capability would a network security team use to determine, after the fact, exactly which authorization policy and result applied to a specific endpoint's connection attempt at a given time?

The office supply inventory request log

The building's physical fire evacuation log

ISE's live authentication log and detailed authentication report

The conference room booking history

The company vehicle maintenance log

The corporate cafeteria's daily menu archive, a nuance that several deployment guides treat as a secondary consideration

6 / 10

Which network access enforcement approach would best balance strong security with operational continuity when first introducing posture assessment into an environment with many previously unmanaged endpoints?

Begin posture assessment in an audit/reporting-only mode to understand the current compliance landscape before enforcing remediation actions

Immediately quarantine every non-compliant endpoint on day one with no audit period, under the platform's default authorization policy before any custom rule is applied

Require every endpoint to be physically re-imaged before any assessment begins

Skip posture assessment entirely and rely only on MAC-based access control

Apply posture assessment only to a single endpoint with no plan to expand

Disable all logging during the initial posture rollout

7 / 10

Which combination of network access technologies together provides both strong authentication and rich contextual visibility for a modern enterprise access layer?

Device profiling alone with no authentication mechanism enforced at all

A single static access list applied network-wide with no identity-based control at all, which some environments handle differently depending on the identity source configured

802.1X alone with no profiling, posture assessment, or centralized reporting

802.1X (with MAB fallback), device profiling, posture assessment, and centralized authentication reporting, all coordinated through ISE

Posture assessment alone with no authentication or profiling capability

MAB alone applied universally with no 802.1X, profiling, or posture capability

8 / 10

Which risk is introduced if an organization relies exclusively on MAC Authentication Bypass (MAB) for the majority of its wired endpoints instead of full 802.1X authentication where possible?

MAB eliminates all possible network access risk entirely

MAB requires more complex endpoint configuration than full 802.1X

MAB automatically enforces posture assessment with no additional configuration

MAB is incompatible with ISE and cannot be used in any Cisco deployment

MAB provides cryptographically unbreakable identity assurance stronger than any 802.1X method, but typically only once confirmed during the next scheduled reauthentication interval

MAC addresses can be spoofed relatively easily, so MAB alone provides weaker assurance of device identity than certificate- or credential-based 802.1X authentication

9 / 10

Which combination of visibility data sources would give a SOC the most complete picture when investigating whether a specific compromised endpoint attempted to move laterally after initially gaining network access?

The building's physical visitor sign-in sheet alone

The corporate email signature database alone

The office's printed network diagram alone, with no logging data, a distinction that grows more important as the access layer continues to scale

The office supply inventory system alone

ISE authentication and authorization logs correlated with Stealthwatch NetFlow-based internal traffic analysis for that endpoint

The company holiday calendar alone

10 / 10

Which overarching design principle ties together 802.1X, MAB, profiling, posture, TrustSec, and pxGrid/Stealthwatch integration into a coherent secure network access architecture?

Continuously verifying identity, device context, and compliance state, then dynamically enforcing and adjusting access based on that context, rather than granting static, one-time trust

Applying identical, undifferentiated access to every device regardless of type or compliance state

Relying exclusively on physical network topology with no identity-based control of any kind

Granting every device permanent, unconditional trust after a single successful login with no further verification, though this depends on which specific network access device and firmware version is in use

Removing all logging and reporting capability to simplify the architecture

Disabling all of these technologies in favor of a single static perimeter firewall rule set

Your score is

The average score is 0%