SkillTestPro | CCNP Security 300-715 SISE Practice Test 8

CCNP Security 300-715 SISE Practice Test 8 (Hard) - Implementing MAC Authentication Bypass (MAB)

CISCO CCNP Security Exam Logo

1 / 10

Which authentication method authenticates a device to the network using its MAC address instead of requiring 802.1X supplicant software or user-entered credentials?

SAML-based single sign-on authentication

Kerberos-based domain authentication

PEAP with MSCHAPv2 credential-based authentication

EAP-TLS certificate-based authentication

MAC Authentication Bypass (MAB)

TACACS+ device administration authentication

2 / 10

Which type of endpoint is MAC Authentication Bypass typically intended to support in a Cisco ISE deployment?

Only Cisco ISE administrator workstations exclusively

Only wireless controllers themselves, never end-user devices

Devices that fully support the most advanced EAP-TLS certificate exchange with no limitations

Only devices used exclusively for TACACS+ device administration

Devices that cannot perform 802.1X, such as many printers, IoT devices, and certain legacy equipment

Only devices running the latest version of a corporate-managed operating system with full 802.1X supplicant support

3 / 10

Which Cisco ISE identity store is commonly used to validate the MAC address presented during a MAB authentication attempt?

A sponsor group configuration with no relationship to MAC addresses

A native Active Directory group used exclusively for human user accounts

A TACACS+ command set with no relationship to MAC addresses

A guest portal branding configuration with no relationship to MAC addresses

The internal endpoint identity store (or an external endpoint database), often supplemented by profiling data

A certificate authentication profile expecting an X.509 certificate rather than a MAC address, under typical configuration conditions

4 / 10

Which security limitation is commonly associated with MAC Authentication Bypass compared to certificate-based or credential-based 802.1X authentication?

MAB requires the same certificate infrastructure as EAP-TLS, making it equally strong

MAB is completely immune to any form of spoofing or impersonation

MAB eliminates the need for any profiling or endpoint visibility whatsoever

MAB cannot be used alongside any authorization policy restrictions at all

MAB provides stronger identity assurance than any certificate-based method under all circumstances, regardless of the platform version in use, which is rarely the correct choice

MAC addresses can be spoofed relatively easily, so MAB provides weaker identity assurance than certificate- or credential-based authentication

5 / 10

Which Cisco ISE capability helps mitigate the weaker identity assurance of MAB by additionally analyzing device attributes (such as DHCP options or HTTP user-agent strings) to validate that a device's behavior matches its claimed identity?

Certificate authentication profile configuration

Sponsor portal configuration

TACACS+ command authorization

Profiling services

Guest type configuration

Client provisioning resource configuration

6 / 10

Which authorization outcome would be appropriate to apply via Cisco ISE policy to a device that successfully passes MAB but has limited verified trust compared to a certificate-authenticated corporate laptop?

Automatic promotion to a Cisco ISE administrator account

Full administrative access to every network device via TACACS+, in most deployment scenarios

A more restrictive authorization profile, such as a limited VLAN or ACL, reflecting the device's lower assurance level

Unrestricted access to sensitive internal servers with no additional verification

Complete exemption from all future authentication requirements permanently

Exactly the same unrestricted authorization profile as a fully certificate-authenticated corporate laptop, in accordance with common design practices, which is not the standard approach

7 / 10

Which deployment practice helps reduce the operational burden of manually pre-registering every MAB-authenticated device's MAC address in Cisco ISE?

Requiring every employee to personally visit the network operations center to register their device's MAC address in person

Manually typing every single MAC address into a spreadsheet with no automation of any kind, in most deployment scenarios, based on standard platform behavior, under typical configuration conditions, which does not align with best practices

Using profiling policies to automatically classify and, where appropriate, dynamically authorize devices based on observed attributes rather than requiring fully manual registration of every MAC address

Disabling MAB entirely to avoid any registration effort

Randomly assigning authorization profiles with no relationship to the device's actual attributes

Refusing network access to any device not manually registered, with no profiling or fallback option at all

8 / 10

Which sequencing relationship is common between 802.1X and MAB on a wired switchport configured with IBNS 2.0 flexible authentication?

MAB is only usable on wireless networks and never on wired switchports

MAB always takes priority over 802.1X with no possibility of reordering

802.1X is typically attempted first, and if it times out or the device does not respond as an 802.1X supplicant, the port falls back to attempting MAB

MAB and 802.1X can never be configured together on the same switchport under any circumstance, under normal operating conditions, which is inconsistent with expected behavior

802.1X must be completely disabled network-wide before MAB can be enabled anywhere

802.1X and MAB always run permanently simultaneously with no sequencing logic at all

9 / 10

Which risk arises from relying on MAB as the sole authentication method for a large population of endpoints without any supplementary profiling or authorization restriction?

MAB alone would automatically generate certificates for every connected device with no further configuration

MAB alone would automatically apply the strictest possible authorization profile to every device with no configuration needed, which is inconsistent with expected behavior

MAB alone would automatically encrypt all traffic on the network with no further configuration needed

MAB alone would eliminate the need for any RADIUS server entirely

An attacker could spoof a permitted MAC address to gain the same level of network access as the legitimate device, since MAB alone does not strongly verify identity

MAB alone would automatically prevent any device from ever changing its MAC address

10 / 10

Which combination of practices would provide a reasonably secure MAB deployment for a large number of non-802.1X-capable IoT devices in a Cisco ISE environment?

Using MAB alone with no profiling and granting full network access to every device that passes, which is not the standard approach, in most deployment scenarios

Applying the exact same unrestricted authorization profile used for certificate-authenticated corporate laptops

Disabling all authorization policy for MAB-authenticated devices to simplify configuration

Never reviewing or auditing MAB-authenticated device lists after initial registration

Combining MAB with profiling to validate device behavior, applying restrictive, least-privilege authorization profiles, and periodically reviewing registered devices for anomalies

Allowing any MAC address to pass MAB with no verification of any kind

Your score is

The average score is 0%