Skip to content
AvailabilitySign inBook a DemoStart free lab
Topic: 802.1X & Network Access ControlSwitch
All CCNP topics

5.0 Security

802.1X & Network Access Control Practice Questions

802.1X, MAB, and Cisco ISE for identity-based network access.

One solved question, so you can see how these are marked

What authentication and key-establishment change occurs when upgrading from WPA2-Personal to WPA3-Personal?

PSK is replaced by Simultaneous Authentication of Equals (SAE), based on the Dragonfly key exchange.

WPA3-Personal replaces WPA2's PSK-based authentication and key establishment with SAE, which resists offline dictionary attacks. The subsequent 4-way handshake is still used to derive and install session keys.

Every question in the set below is marked like this. The answers stay hidden until you pick one.

All 8 802.1X & Network Access Control questions in this set

Answers and explanations appear when you work through the set above.

  1. Which EAP type provides mutual authentication requiring digital certificates on both the client device (supplicant) and the authentication server?

    • PEAPv0 (EAP-MSCHAPv2)
    • EAP-FAST
    • EAP-TLS
    • LEAP

  2. What IEEE standard specifies MACsec, providing link-layer encryption and data integrity between directly connected Ethernet switches?

    • IEEE 802.1X-2010
    • IEEE 802.1AE
    • IEEE 802.11i
    • IEEE 802.3ad

  3. Which Cisco security solution ingests Flexible NetFlow and switch telemetry to perform behavior-based anomaly detection and identify insider threats, including in encrypted traffic?

    • Cisco Secure Network Analytics (Stealthwatch)
    • Cisco Identity Services Engine (ISE) Profiler service
    • Cisco Secure Email Gateway with Outbreak Filters
    • Cisco Umbrella DNS-layer security (formerly OpenDNS)

  4. An 802.1X switch port is expected to block normal traffic until the endpoint authenticates. Which port-control setting produces that behavior?

    • force-authorized
    • force-unauthorized
    • auto
    • multi-auth

  5. In FlexConnect AP deployments, how is wireless client traffic handled when configured in FlexConnect Local Switching mode?

    • The AP tunnels the data frames inside CAPWAP back to the central WLC, which then switches them onto a VLAN.
    • The AP converts the frames to Ethernet itself and bridges them onto the VLAN of the local access switch.
    • The AP sends the data frames through an encrypted GRE tunnel to Cisco ISE for inspection before forwarding.
    • The AP stops forwarding client data entirely whenever its CAPWAP connection to the controller goes down.

  6. Against which table does Dynamic ARP Inspection (DAI) validate incoming ARP Request and Response packets received on untrusted interfaces?

    • CAM table (MAC address table)
    • DHCP Snooping Binding Database
    • Cisco ISE SXP binding table
    • IP Device Tracking (IPDT) table

  7. Which prerequisite security feature must be globally enabled on a Cisco switch before IP Source Guard (IPSG) can function on access ports?

    • Control Plane Policing (CoPP)
    • DHCP Snooping
    • Port Security
    • IEEE 802.1X Access Control

  8. In Cisco IOS Zone-Based Policy Firewall (ZBF), what is the default security policy applied to traffic flowing between interfaces assigned to the same security zone?

    • All traffic is dropped unless explicitly permitted.
    • All traffic passes implicitly without restriction.
    • Traffic is inspected statefully and logged.
    • Traffic is sent to an external ISE node for validation.