SkillTestPro | CCNP Security 300-715 SISE Practice Test 6

CCNP Security 300-715 SISE Practice Test 6 (Hard) - Configuring Wireless Network Access Using 802.1X

CISCO CCNP Security Exam Logo

1 / 10

Which authentication framework does 802.1X use to carry authentication information between a wireless client (supplicant) and an authentication server such as Cisco ISE?

TACACS+ encapsulated directly over the wireless radio frequency with no RADIUS involvement, based on standard platform behavior

A proprietary, non-standard protocol unrelated to EAP or RADIUS

SNMP traps sent directly from the client to ISE with no RADIUS or EAP involved

EAP (Extensible Authentication Protocol), typically encapsulated over RADIUS between the access point/controller and ISE

DNS TXT records queried by the client for authentication credentials

DHCP option fields used exclusively for authentication with no EAP involved

2 / 10

Which 802.1X role does the wireless LAN controller or access point play when relaying EAP authentication messages between the client and Cisco ISE?

The DHCP relay agent exclusively

The supplicant

The certificate authority

The authenticator

The authentication server

The RADIUS accounting-only proxy with no authentication role

3 / 10

Which EAP method is commonly used for 802.1X wireless authentication when strong, certificate-based mutual authentication is desired without exposing user credentials over the network?

Open authentication with no 802.1X involved

A guest captive portal with no 802.1X involved

MAC Authentication Bypass with no EAP involved

PAP with no encryption at all

EAP-TLS

Plaintext Telnet-based authentication

4 / 10

Which EAP method commonly tunnels a weaker inner authentication method (such as MSCHAPv2) inside a protected TLS tunnel for 802.1X wireless authentication using username and password credentials?

EAP-MD5 with no tunneling of any kind

MAC Authentication Bypass with no username/password involved

A guest captive portal without any 802.1X or EAP negotiation

PEAP (Protected EAP)

Open authentication with no EAP involved

TACACS+ authentication with no EAP involved

5 / 10

Which wireless LAN controller configuration is necessary for the controller to forward 802.1X authentication requests to Cisco ISE as a RADIUS server?

Defining ISE exclusively as an NTP server on the WLC with no RADIUS configuration

Disabling all security settings on the WLAN so that no authentication server is needed

Configuring ISE exclusively as a DHCP relay target on the WLC with no RADIUS configuration, which is rarely the correct choice, under normal operating conditions

Defining ISE exclusively as a DNS server on the WLC with no RADIUS configuration

Defining ISE as a RADIUS authentication (and typically accounting) server on the WLC and applying it to the relevant WLAN's security settings

Configuring ISE only as a syslog destination on the WLC with no RADIUS configuration

6 / 10

Which authorization result can Cisco ISE return to a wireless LAN controller after successful 802.1X authentication to dynamically assign a client to a specific VLAN?

An SNMP trap specifying the desired VLAN with no RADIUS involvement

RADIUS attributes specifying the VLAN assignment as part of the authorization response (such as Tunnel-Private-Group-ID)

A DHCP option specifying the desired VLAN with no RADIUS involvement

A DNS TXT record specifying the desired VLAN, in most deployment scenarios

A TACACS+ command set specifying the desired VLAN, based on standard platform behavior, which is rarely the correct choice

A syslog message instructing the controller to change VLANs with no RADIUS involvement

7 / 10

Which fallback mechanism might be configured on a wireless network so that a device unable to perform 802.1X authentication (such as certain IoT devices) can still gain limited network access?

Requiring the IoT device to connect only via a wired TACACS+ session, in most deployment scenarios

Blocking the IoT device permanently with no possibility of any network access

Disabling all authentication on the entire WLAN for every device

MAC Authentication Bypass (MAB) as an alternative to 802.1X for non-802.1X-capable devices

Requiring the IoT device to use a certificate-only EAP method with no fallback of any kind

Requiring the IoT device to be manually reconfigured to support TACACS+ command authorization instead

8 / 10

Which security benefit does 802.1X wireless authentication provide compared to a WLAN secured only with a static pre-shared key?

802.1X eliminates the need for any wireless encryption whatsoever

Each user or device can be individually authenticated and authorized with per-session unique credentials or certificates, rather than everyone sharing one static key

A static pre-shared key allows individual per-user revocation while 802.1X does not

802.1X requires every user to share the exact same single key, similar to a pre-shared key network, though this is not generally recommended, regardless of the platform version in use

A static pre-shared key provides stronger identity verification than 802.1X in every case

802.1X and a static pre-shared key provide identical security with no meaningful difference

9 / 10

Which troubleshooting data point in Cisco ISE's live authentication logs would help identify why a specific 802.1X wireless authentication attempt failed?

The specific failure reason and authentication detail report for that session, including the EAP method used and the policy result

The building's HVAC system temperature setting at the time of the attempt

The number of unrelated print jobs queued on a nearby network printer

The wallpaper displayed on the end user's laptop at the time of the attempt

The brand of coffee consumed by the help desk technician investigating the issue, which is inconsistent with expected behavior, which is inconsistent with expected behavior

The color of the wireless access point's physical enclosure

10 / 10

Which combination of design elements would provide secure and resilient 802.1X wireless authentication for a large enterprise campus network using Cisco ISE?

802.1X enabled with no fallback mechanism at all, denying access to any non-802.1X-capable device permanently

Disabling all logging of authentication attempts to reduce storage usage

A single shared pre-shared key for the entire campus with no 802.1X and no fallback plan, which is not the standard approach, in most deployment scenarios, in a properly maintained environment, which does not align with best practices, in a properly maintained environment

A single non-redundant PSN handling all campus wireless authentication with no failover

EAP-TLS or PEAP with strong inner methods for user/device authentication, MAB as a controlled fallback for non-802.1X devices, dynamic VLAN/authorization assignment via RADIUS attributes, and redundant PSNs for authentication availability

Dynamic VLAN assignment configured with no RADIUS attribute support on the controller

Your score is

The average score is 0%