SkillTestPro | CCNP Security 300-715 SISE Practice Test 7

CCNP Security 300-715 SISE Practice Test 7 (Hard) - Configuring Wired Network Access Using 802.1X and IBNS 2.0

CISCO CCNP Security Exam Logo

1 / 10

Which Cisco switch feature set, built on flexible authentication and Common Classification Policy Language, provides advanced control over how wired 802.1X, MAB, and web authentication are sequenced and applied on a switchport?

Spanning Tree Protocol

Legacy single-method-only 802.1X with no flexible sequencing capability

Hot Standby Router Protocol

Simple Network Management Protocol

Dynamic Trunking Protocol

IBNS 2.0 (Identity-Based Networking Services 2.0)

2 / 10

Which IBNS 2.0 host mode allows only a single authenticated (or authorized) endpoint's traffic on a switchport, blocking traffic from any additional connected devices?

Multi-authentication (multi-auth) mode with no restriction on device count

Multi-domain authentication mode with no restriction on device count

Closed mode is unrelated to host mode restrictions, based on standard platform behavior

Multi-host mode

Single-host mode

Monitor mode with no restriction on device count

3 / 10

Which wired 802.1X deployment phase allows administrators to observe authentication results and gather visibility without actually enforcing access restrictions on non-compliant endpoints?

Single-host mode, which governs device count and not enforcement visibility

Multi-host mode, which governs device count and not enforcement visibility

Low impact mode with full enforcement from day one

Multi-domain authentication mode, which governs data/voice separation and not enforcement visibility

Closed mode with full enforcement from day one

Monitor mode

4 / 10

Which wired 802.1X deployment phase applies a permissive default ACL that allows limited necessary traffic (such as DHCP and DNS) for all devices while still enforcing full access only after successful authentication?

Single-host mode, which governs device count rather than default ACL behavior

Multi-host mode, which governs device count rather than default ACL behavior

Closed mode, which denies all traffic until authentication succeeds with no permissive default ACL

Low impact mode

Multi-domain authentication mode, which governs data/voice separation rather than default ACL behavior

Monitor mode, which does not enforce any restrictions at all

5 / 10

Which wired 802.1X deployment phase denies all network access on a port until the connected device successfully authenticates, representing the strictest enforcement level?

Multi-host mode, which governs device count rather than default access enforcement

Single-host mode, which governs device count rather than default access enforcement

Multi-domain authentication mode, which governs data/voice separation rather than default access enforcement

Closed mode

Low impact mode, which allows limited default traffic before authentication

Monitor mode, which does not deny access at all

6 / 10

Which recommended deployment sequence is commonly used when rolling out wired 802.1X with IBNS 2.0 across an existing production network to minimize disruption?

Deploy closed mode only on printers while leaving all other devices with no authentication configured at all

Deploy low impact mode first, then monitor mode, then immediately disable 802.1X entirely

Deploy directly in closed mode on day one with no monitor or low impact phase at all, which is inconsistent with expected behavior, based on standard platform behavior, which is not the standard approach

Start in monitor mode to gain visibility, move to low impact mode to apply a permissive baseline, and finally move to closed mode for full enforcement once the environment is validated

Deploy only in monitor mode permanently with no plan to ever enforce restrictions

Skip all phased deployment and randomly toggle between modes with no plan

7 / 10

Which host mode would be appropriate for a switchport connecting an IP phone with a PC attached behind it, where both the phone (voice domain) and the PC (data domain) need to be independently authenticated?

Multi-host mode, which authenticates only the first device and then opens access to all others with no independent authentication

Monitor mode, which is a deployment phase and not a host-count mode

Multi-domain authentication (MDA) host mode

Low impact mode, which is an enforcement phase and not a host-count mode

Closed mode, which is an enforcement phase and not a host-count mode

Single-host mode, which permits only one device total on the port

8 / 10

Which IBNS 2.0 concept allows administrators to define a policy that sequences 802.1X first, then falls back to MAB, and finally falls back to web authentication if earlier methods fail or time out?

A single, unconfigurable, hardcoded authentication method with no fallback capability at all

A flexible authentication and authorization policy built with Cisco Common Classification Policy Language (C3PL) event/class/action logic

A Spanning Tree Protocol configuration with no relationship to authentication method sequencing

An SNMP polling interval setting with no relationship to authentication method sequencing

A DHCP snooping policy with no relationship to authentication method sequencing

A static ACL applied manually with no relationship to authentication method sequencing

9 / 10

Which risk would most likely result from deploying wired 802.1X directly in closed mode across an entire production network without first using monitor mode to validate readiness?

Legitimate devices that are not yet properly configured for authentication could be unexpectedly denied network access, causing widespread connectivity disruption

The organization's DNS infrastructure would be automatically and permanently disabled network-wide

All connected devices would be automatically and permanently converted to use only IPv6 addressing

Every device on the network would automatically gain full unrestricted access with no authentication required at all, under normal operating conditions, under typical configuration conditions

The switches would permanently and irreversibly lose all previously configured VLAN information

Switches would automatically revert permanently to hub-like behavior with no port security of any kind

10 / 10

Which combination of IBNS 2.0 design choices would provide a secure but operationally safe wired 802.1X rollout for a large campus with a mix of PCs, IP phones, and printers?

Skipping the monitor mode phase entirely and relying only on anecdotal user reports of connectivity issues

Disabling 802.1X entirely on all printer ports with no MAB and no monitoring at all

Deploying closed mode immediately everywhere with single-host mode only and no MAB fallback for printers, in accordance with common design practices, which is not the standard approach

Applying single-host mode to phone/PC ports, which would block one of the two devices from ever authenticating

Using multi-host mode everywhere so that any device behind an authenticated device is automatically trusted with no further authentication

A phased rollout from monitor mode to low impact mode to closed mode, multi-domain authentication host mode on phone/PC ports, and MAB as a fallback for non-802.1X-capable printers

Your score is

The average score is 0%