I85PREP
⌘ K
Cisco ENNA 300-445 study materials
Cisco ENNA 300-445 study resources

Cisco ENNA 300-445 practice questions

One question at a time. Build your Cisco ENNA 300-445 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Fundamentals

A switch port configured with the access VLAN 20 receives an untagged frame. How does the switch treat that frame as it enters the port?

  1. It associates the frame with VLAN 20 and keeps it untagged internally. Correct answer.
  2. It drops the frame because access ports accept only tagged traffic.
  3. It tags the frame with every VLAN permitted on the switch.
  4. It associates the frame with the native VLAN of the trunk instead.

Explanation

An access port belongs to exactly one data VLAN, and any untagged frame arriving on it is classified into that VLAN. The switch then forwards the frame internally with that VLAN association, and egress on another access port is sent untagged again.

Question 2Network Fundamentals

Which statement describes the purpose of the 802.1Q tag inserted by a trunk port?

  1. It carries a 12-bit VLAN identifier so the receiving switch can classify the frame. Correct answer.
  2. It encrypts the payload between two switches on the same segment.
  3. It limits the frame to 64 bytes to reduce trunk overhead.
  4. It replaces the source MAC address with the VLAN interface MAC.

Explanation

The 802.1Q header adds a 4-byte field containing a 12-bit VLAN ID (VID) plus priority and drop-eligible bits. The receiving trunk port reads the VID to decide which VLAN the frame belongs to before forwarding it.

Question 3Network Fundamentals

Two hosts are in the same VLAN but connected to different access switches joined by a trunk. Which device function allows them to communicate at Layer 2 without a router?

  1. The trunk converts the frame into a Layer 3 packet before forwarding.
  2. The trunk performs inter-VLAN routing using the VLAN ID as a next hop.
  3. The trunk forwards frames based on the destination MAC address learned in the VLAN. Correct answer.
  4. The trunk rewrites the destination IP address to the peer switch address.

Explanation

A trunk extends a VLAN across multiple switches, so the combined broadcast domain behaves as one Layer 2 segment. Each switch learns destination MAC addresses per VLAN and forwards frames out the appropriate port, including the trunk, without any routing.

Question 4Network Fundamentals

Which address range is reserved for link-local IPv6 unicast addresses?

  1. 2001:DB8::/32
  2. FF00::/8
  3. FC00::/7
  4. FE80::/10 Correct answer.

Explanation

IPv6 link-local addresses are formed in the FE80::/10 range and are valid only on a single link. They are commonly derived automatically from the interface identifier and are used for neighbor discovery and next-hop resolution.

Question 5Network Fundamentals

A host with address 10.20.30.40/26 needs to reach a server at 10.20.30.70. What does the host conclude?

  1. The host must first perform a reverse DNS lookup before forwarding.
  2. The server is on a different subnet, so the host sends the frame to its default gateway. Correct answer.
  3. The server is on the same subnet, so the host ARPs for the server directly.
  4. The server address is invalid because .70 exceeds the /26 range.

Explanation

A /26 mask leaves 64 addresses per subnet, so the subnets are 10.20.30.0-63, 10.20.30.64-127, and so on. The host at .40 is in the first subnet while .70 is in the second, so traffic must go through the default gateway.

Question 6Network Fundamentals

Which mechanism allows a single physical link to carry traffic for multiple VLANs between two switches?

  1. Configuring the link as a routed port
  2. Configuring the link as an 802.1Q trunk Correct answer.
  3. Assigning the link to a single access VLAN
  4. Enabling PortFast on the link

Explanation

An 802.1Q trunk tags frames with a VLAN identifier so several VLANs can share one physical link. The receiving switch reads the tag and forwards the frame into the matching VLAN.

Question 7Network Fundamentals

What is the primary purpose of the Spanning Tree Protocol on a switched network?

  1. To assign VLAN identifiers to frames on trunk links
  2. To authenticate hosts before they join a VLAN
  3. To load-balance traffic across all redundant links simultaneously
  4. To prevent Layer 2 loops by blocking redundant paths Correct answer.

Explanation

Without STP, redundant Layer 2 paths would cause broadcast frames to circulate indefinitely and flood the network. STP elects a root bridge and places redundant ports into a blocking state so only a loop-free topology is active.

Question 8Network Fundamentals

A network engineer wants to route between VLAN 10 and VLAN 20 on a single multilayer switch. Which configuration provides this capability?

  1. Disable STP on both VLANs so frames can cross between them.
  2. Place both VLANs on the same access port so they share a subnet.
  3. Create switched virtual interfaces for both VLANs and enable IP routing on the switch. Correct answer.
  4. Configure a trunk port and rely on the trunk to route between the VLANs.

Explanation

Inter-VLAN routing on a multilayer switch uses switched virtual interfaces (SVIs) that each hold an IP address in the VLAN subnet. With IP routing enabled, the switch forwards packets between the SVIs.

Question 9Network Fundamentals

Which statement about the native VLAN on an 802.1Q trunk is correct?

  1. Frames in the native VLAN cross the trunk untagged. Correct answer.
  2. The native VLAN is used only for management traffic.
  3. The native VLAN must be VLAN 1 on all vendors.
  4. Frames in the native VLAN are always dropped at the trunk.

Explanation

802.1Q defines a native VLAN whose frames are transmitted without a tag, while all other VLANs are tagged. For security and consistency, best practice is to set the native VLAN to an unused VLAN and match it on both ends of the trunk.

Question 10Network Fundamentals

A router-on-a-stick design connects a router to a switch over one trunk link. What must the router subinterface for VLAN 30 include?

  1. A switchport mode trunk command on the subinterface
  2. A spanning-tree portfast command on the subinterface
  3. An access VLAN 30 command on the physical interface
  4. An encapsulation dot1Q 30 command and an IP address in the VLAN 30 subnet Correct answer.

Explanation

Router subinterfaces must specify the 802.1Q encapsulation and VLAN ID so the router can match tagged frames to the correct subinterface. Each subinterface then needs an IP address that serves as the default gateway for hosts in that VLAN.

Question 11Network Fundamentals

Which protocol resolves an IPv4 address to a MAC address on a local subnet?

  1. DNS
  2. ARP Correct answer.
  3. ICMP
  4. DHCP

Explanation

ARP broadcasts a request asking which device owns a given IPv4 address, and the owner replies with its MAC address. The mapping is then cached so subsequent frames can be encapsulated with the correct destination MAC.

Question 12Network Fundamentals

A host sends a packet to a destination outside its subnet. What destination MAC address appears in the frame the host transmits?

  1. The MAC address of the final destination host
  2. The MAC address of the DNS server
  3. The broadcast MAC address FF:FF:FF:FF:FF:FF
  4. The MAC address of the default gateway interface Correct answer.

Explanation

When the destination IP is off-subnet, the host resolves the gateway's IP to its MAC and builds the frame with that gateway MAC. The destination IP remains the remote host, and each router repeats this process for the next hop.

Question 13Network Fundamentals

Which statement correctly compares TCP and UDP?

  1. Both protocols are connectionless, but only TCP performs error checking.
  2. Both protocols guarantee delivery, but only UDP uses port numbers.
  3. TCP provides reliable, ordered delivery with acknowledgments; UDP provides connectionless best-effort delivery. Correct answer.
  4. TCP is connectionless and faster; UDP guarantees delivery with retransmissions.

Explanation

TCP establishes a session, sequences segments, acknowledges receipt, and retransmits lost data. UDP sends datagrams without handshakes or acknowledgments, which suits delay-sensitive traffic such as voice and DNS queries.

Question 14Network Fundamentals

A server listens on TCP port 443. Which field in the TCP header lets the server distinguish this connection from a second simultaneous connection from the same client host?

  1. The urgent pointer
  2. The checksum
  3. The source port number Correct answer.
  4. The acknowledgment number

Explanation

A TCP connection is identified by the four-tuple of source IP, source port, destination IP, and destination port. The client uses a different ephemeral source port for each connection, letting the server track them separately on port 443.

Question 15Network Fundamentals

Which IPv4 address is a valid host address in the 192.168.10.0/24 network?

  1. 192.168.10.0
  2. 192.168.10.255
  3. 192.168.10.254 Correct answer.
  4. 192.168.11.1

Explanation

In a /24 network, .0 is the network address and .255 is the directed broadcast address, leaving .1 through .254 for hosts. Address 192.168.11.1 belongs to a different /24 network.

Question 16Network Fundamentals

A host is configured with IP address 169.254.10.5/16 and no other information. What does this configuration most likely indicate?

  1. The host is using a public address assigned by its ISP.
  2. The host is configured as a DHCP relay agent.
  3. The host failed to obtain a DHCP lease and self-assigned a link-local address. Correct answer.
  4. The host received a valid lease from a DHCP server on the local subnet.

Explanation

The 169.254.0.0/16 range is the IPv4 link-local block used by APIPA-style self-assignment. A host falls back to this range when DHCP discovery fails, which usually points to a missing or unreachable DHCP server.

Question 17Network Fundamentals

Which device operates primarily at Layer 2 and makes forwarding decisions using a MAC address table?

  1. A load balancer distributing HTTP requests
  2. A Layer 2 switch Correct answer.
  3. A router
  4. A firewall performing stateful inspection

Explanation

A Layer 2 switch learns source MAC addresses per port and forwards frames toward the port associated with the destination MAC. Routers instead forward based on Layer 3 destination addresses and routing tables.

Question 18Network Fundamentals

A switch receives a frame whose destination MAC address is not in its MAC address table. What does the switch do?

  1. It floods the frame out all ports in the same VLAN except the ingress port. Correct answer.
  2. It discards the frame and sends an ICMP unreachable message.
  3. It forwards the frame only to the default gateway port.
  4. It holds the frame until the destination host sends a frame.

Explanation

Unknown unicast frames are flooded within the VLAN so the destination can be reached even before the table is populated. Once the destination replies, the switch learns its MAC address and subsequent frames are forwarded only to that port.

Question 19Network Fundamentals

Which statement about a collision domain on a switch is correct?

  1. All ports on a switch share a single collision domain.
  2. Collision domains are defined by VLAN IDs rather than by ports.
  3. Collision domains exist only on trunk ports.
  4. Each switch port forms its own collision domain in full-duplex operation. Correct answer.

Explanation

A switch creates a separate collision domain per port, and in full-duplex mode collisions are eliminated entirely. Hubs, by contrast, place all connected devices in one shared collision domain.

Question 20Network Fundamentals

An engineer needs to allow only VLANs 10 and 20 across a trunk while preventing all other VLANs from traversing it. Which configuration accomplishes this?

  1. Set the native VLAN to 10 and leave the allowed list at default.
  2. Assign the trunk port to access VLAN 10.
  3. Set the trunk allowed VLAN list to 10,20. Correct answer.
  4. Disable DTP on the trunk and leave the allowed list at default.

Explanation

The allowed VLAN list on a trunk controls which VLANs may pass over the link. Restricting it to 10 and 20 prunes all other VLAN traffic, which also reduces unnecessary flooding.

Question 21Network Fundamentals

Which IPv6 address type is used to deliver a single packet to the nearest member of a group, as with a default gateway address?

  1. Broadcast
  2. Unicast
  3. Multicast
  4. Anycast Correct answer.

Explanation

An anycast address is assigned to multiple devices, and packets are delivered to the topologically nearest one. IPv6 uses anycast for services such as the default router address in router advertisements.

Question 22Network Fundamentals

A network uses OSPF, and a router has two equal-cost paths to the same destination network. What does the router do by default?

  1. It installs both paths and load-balances traffic across them. Correct answer.
  2. It discards both routes until the costs differ.
  3. It installs only the path with the lower interface MAC address.
  4. It installs only the path learned most recently.

Explanation

When multiple routes to the same prefix have identical cost and administrative distance, the router performs equal-cost multipath load balancing. Traffic is distributed across the installed next hops according to the platform's hashing method.

Question 23Network Fundamentals

Which statement about administrative distance is correct?

  1. It sets the maximum hop count for OSPF routes.
  2. It defines the VLAN priority carried in an 802.1Q tag.
  3. It ranks the trustworthiness of route sources so the router prefers one source over another. Correct answer.
  4. It measures the bandwidth of the path to a destination.

Explanation

Administrative distance is a local value that ranks the believability of different routing information sources, such as connected, static, and various dynamic protocols. When sources disagree about a prefix, the lower administrative distance wins before any metric comparison.

Question 24Network Fundamentals

Which protocol provides first-hop redundancy so hosts keep a consistent default gateway if the active router fails?

  1. LACP
  2. STP
  3. NTP
  4. HSRP Correct answer.

Explanation

First-hop redundancy protocols such as HSRP, VRRP, and GLBP present a shared virtual IP and MAC address to hosts. If the active router fails, a standby router assumes the virtual address so host gateways remain valid.

Question 25Network Fundamentals

A company wants to connect two data centers over a Layer 2 service while keeping VLANs isolated. Which technology encapsulates customer Ethernet frames with a service-provider tag?

  1. PortFast
  2. Dynamic ARP Inspection
  3. Q-in-Q VLAN stacking Correct answer.
  4. OSPF area configuration

Explanation

Q-in-Q adds an outer service-provider VLAN tag around the customer's 802.1Q tag, allowing the provider to transport many customer VLANs transparently. The outer tag identifies the customer on the provider network while the inner tag preserves customer VLAN semantics.

Question 26Network Fundamentals

A switch port is configured with the command switchport port-security maximum 2 and switchport port-security violation restrict. What happens when a third MAC address attempts to send traffic through that port?

  1. The frame is dropped, a violation counter increments, and a log message is generated. Correct answer.
  2. The new MAC address replaces the oldest entry in the secure table and forwarding continues.
  3. The port stops forwarding for 30 seconds and then automatically resumes learning.
  4. The port is placed into the err-disabled state and stays down until manually recovered.

Explanation

The restrict violation mode drops frames from MAC addresses that exceed the configured maximum, increments the security violation counter, and can send a syslog or SNMP trap. Unlike shutdown mode, the interface stays up and keeps forwarding traffic from already-learned addresses.

Question 27Network Fundamentals

Which statement describes the behavior of a switch port configured as an access port?

  1. It forwards traffic for all VLANs in the VLAN database by default.
  2. It carries multiple VLANs and tags every frame with an 802.1Q header.
  3. It dynamically negotiates trunking with the neighboring device using DTP.
  4. It belongs to exactly one VLAN and sends frames untagged to attached end devices. Correct answer.

Explanation

An access port is assigned to a single VLAN and presents frames to the connected host without an 802.1Q tag. Tagging and multi-VLAN membership are characteristics of trunk ports.

Question 28Network Fundamentals

A network engineer sees the output of show interfaces status showing a port in the err-disabled state with the reason psecure-violation. Which action restores the port to service?

  1. Change the port to a trunk port so the violation condition no longer applies.
  2. Shut down and re-enable the interface, or clear the violation with errdisable recovery settings. Correct answer.
  3. Remove the VLAN assignment from the port and reassign it.
  4. Reload the switch to clear the MAC address table.

Explanation

A port-security violation in shutdown mode err-disables the interface. Recovery requires administratively shutting and re-enabling the port, or configuring errdisable recovery cause psecure-violation with an interval so the switch re-enables it automatically.

Question 29Network Fundamentals

Which statement correctly describes the difference between a routed port and an SVI on a multilayer switch?

  1. A routed port can belong to multiple VLANs, while an SVI belongs to exactly one VLAN.
  2. A routed port is a physical interface with no VLAN association, while an SVI is a virtual interface tied to a VLAN. Correct answer.
  3. A routed port carries 802.1Q tags, while an SVI only carries untagged traffic.
  4. An SVI requires the no switchport command, while a routed port requires switchport mode trunk.

Explanation

A routed port is configured with no switchport and behaves like a router interface with an IP address and no VLAN membership. An SVI is a logical interface associated with a VLAN and provides Layer 3 processing for that VLAN.

Question 30Network Fundamentals

Which two features are provided by Cisco Express Forwarding on a multilayer switch? (Choose the single best answer.)

  1. A forwarding information base and an adjacency table used for fast packet rewriting. Correct answer.
  2. A spanning-tree topology database and a VLAN Trunking Protocol database.
  3. An ARP cache and a DHCP snooping binding database.
  4. A MAC address table and a port-security binding table.

Explanation

CEF builds a forwarding information base from the routing table and an adjacency table containing link-layer rewrite information. Together they allow hardware-based forwarding without per-packet route lookup.

Question 31Network Fundamentals

A host with address 10.1.1.50/26 needs to reach 10.1.1.70. What does the host do?

  1. It sends the packet directly to the destination because both addresses are in the same subnet. Correct answer.
  2. It sends the packet to its default gateway because the destination is in a different subnet.
  3. It drops the packet because the destination address is a broadcast address.
  4. It sends an ARP request for the gateway and forwards the packet to the gateway MAC address.

Explanation

A /26 mask provides subnets in increments of 64, so 10.1.1.0/26 covers addresses .0 through .63. Both .50 and .70 fall in that range, making them local to each other, so the host ARPs for the destination directly.

Question 32Network Fundamentals

Which address range is reserved for IPv4 link-local autoconfiguration when a DHCP server is unreachable?

  1. 169.254.0.0/16 Correct answer.
  2. 172.16.0.0/12
  3. 192.168.0.0/16
  4. 127.0.0.0/8

Explanation

RFC 3927 reserves 169.254.0.0/16 for link-local addressing used by APIPA when no DHCP server responds. The other ranges serve different purposes such as private addressing or loopback.

Question 33Network Fundamentals

Which statement about the default gateway on an IPv4 host is correct?

  1. It must differ from the host address by exactly one.
  2. It must be a public routable address.
  3. It must be the highest usable address in the subnet.
  4. It must be an address in the same subnet as the host interface. Correct answer.

Explanation

A host reaches its gateway through local Layer 2 resolution, so the gateway address must reside in the same subnet as the host. Any usable address in that subnet can serve as the gateway.

Question 34Network Fundamentals

A host sends an ARP request for 192.168.1.1. Which statement describes the frame that carries this request?

  1. It is a multicast frame sent to 01:00:5e:00:00:01.
  2. It is a broadcast frame with a destination IP of 255.255.255.255.
  3. It is a broadcast frame with a destination MAC of ff:ff:ff:ff:ff:ff. Correct answer.
  4. It is a unicast frame addressed to the MAC of 192.168.1.1.

Explanation

An ARP request must reach every station on the local segment, so it is encapsulated in a broadcast frame using ff:ff:ff:ff:ff:ff. The target replies with a unicast ARP response once it recognizes its own IP address.

Question 35Network Fundamentals

Which field in the IPv4 header prevents packets from looping indefinitely when routing is misconfigured?

  1. Header Checksum
  2. Time to Live Correct answer.
  3. Identification
  4. Protocol

Explanation

The Time to Live field is decremented by each router, and a packet is discarded when the value reaches zero. This limits the lifetime of a packet and prevents endless forwarding loops.

Question 36Network Fundamentals

An engineer configures an IPv6 address of 2001:db8:acad::1/64 on an interface. Which address is the corresponding subnet-router anycast address concept applied to?

  1. The solicited-node multicast address ff02::1:ff00:1.
  2. The all-ones interface identifier within the /64 prefix.
  3. The link-local address fe80::1.
  4. The all-zeros interface identifier within the /64 prefix. Correct answer.

Explanation

The subnet-router anycast address uses the subnet prefix with an interface identifier of all zeros. It is reserved for routers on that subnet, and the all-ones identifier is the subnet's directed broadcast equivalent.

Question 37Network Fundamentals

Which protocol enables a host to learn the link-layer address associated with an IPv6 neighbor?

  1. Dynamic Host Configuration Protocol using relay agents.
  2. Internet Control Message Protocol using redirect messages.
  3. Address Resolution Protocol using broadcast requests.
  4. Neighbor Discovery Protocol using neighbor solicitation and advertisement messages. Correct answer.

Explanation

IPv6 replaces ARP with Neighbor Discovery, where a neighbor solicitation is sent to a solicited-node multicast address and the target replies with a neighbor advertisement containing its link-layer address.

Question 38Network Fundamentals

A router receives a packet destined for 10.10.10.5. Its routing table contains 10.10.10.0/24 via 192.168.1.2 and 10.0.0.0/8 via 192.168.1.6. Which route is used and why?

  1. The /8 route, because it was learned from a lower administrative distance source.
  2. Both routes are installed and traffic is load balanced across them.
  3. The /24 route, because the longest prefix match takes precedence over administrative distance. Correct answer.
  4. The /24 route, because it has the higher administrative distance value.

Explanation

When multiple routes match a destination, the router selects the longest matching prefix regardless of administrative distance. Administrative distance is only used to compare routes to the same prefix from different sources.

Question 39Network Fundamentals

Which statement about a floating static route is correct?

  1. It is configured with a higher administrative distance than the primary route so it is used only if the primary fails. Correct answer.
  2. It is automatically installed by a routing protocol when the topology changes.
  3. It is configured with a lower administrative distance than the primary route so it is always preferred.
  4. It uses a metric value of zero to guarantee it is selected first.

Explanation

A floating static route is a backup path configured with an administrative distance greater than the dynamic or primary route. It stays out of the routing table until the preferred route is withdrawn.

Question 40Network Fundamentals

Which statement about a routed link between two routers is correct?

  1. Both interfaces must share the same subnet and the same IP address.
  2. Each interface must be in a different subnet for the routers to forward traffic between them. Correct answer.
  3. The link requires a default gateway configured on each interface.
  4. The interfaces must be configured as trunk ports carrying all VLANs.

Explanation

Point-to-point routed links place each interface in a distinct subnet so that each router treats the other as directly connected via that subnet. Sharing an address or subnet would create an invalid configuration.

Question 41Network Access

In a Cisco SD-Access fabric, which device role encapsulates user traffic into VXLAN and enforces group-based policy at the edge of the fabric?

  1. Fabric edge node Correct answer.
  2. Fabric control plane node
  3. Fabric intermediate node
  4. Fabric border node

Explanation

Fabric edge nodes connect endpoints to the fabric, perform VXLAN encapsulation for traffic entering the fabric, and apply group-based policy and SGACL enforcement for the attached hosts. Border nodes hand traffic off to external networks, while control plane nodes host the LISP map-server functions.

Question 42Network Access

Which protocol does the SD-Access fabric control plane use to resolve endpoint-to-edge-node mappings?

  1. BGP EVPN
  2. LISP Correct answer.
  3. OSPFv3
  4. PIM sparse mode

Explanation

Cisco SD-Access uses LISP as the control plane protocol, with control plane nodes acting as map servers and resolvers that track endpoint EID-to-RLOC mappings. BGP EVPN is used in other VXLAN fabrics such as ACI or data center designs, not in SD-Access control plane resolution.

Question 43Network Access

A network engineer must authenticate wired endpoints using 802.1X with EAP chaining so that both the user and the machine identity are validated. Which Cisco feature provides this capability?

  1. Cisco TrustSec SGT exchange
  2. Cisco Identity Services Engine with EAP-FAST chaining Correct answer.
  3. MAC Authentication Bypass
  4. Web Authentication redirect

Explanation

EAP chaining is an EAP-FAST extension supported by Cisco ISE that carries both machine and user credentials in a single 802.1X conversation. It allows policy to be based on the combined identity rather than a single credential.

Question 44Network Access

Which component of Cisco TrustSec is carried inside the Cisco Metadata header to allow policy enforcement without re-evaluating ACLs on every hop?

  1. Security Group Tag Correct answer.
  2. QoS DSCP value
  3. VRF identifier
  4. VLAN ID

Explanation

The Security Group Tag identifies the source security group of a packet so that downstream devices can enforce SGACLs based on group membership. TrustSec-capable hardware propagates the SGT inline or via SXP when inline tagging is not supported.

Question 45Network Access

A company wants to segment its campus fabric into virtual networks without deploying separate physical infrastructure. Which SD-Access construct provides this isolation?

  1. Fabric role change to border
  2. LISP pub-sub
  3. Virtual network (VN) mapped to a VRF Correct answer.
  4. SGT enforcement at the edge

Explanation

In SD-Access, virtual networks map to VRFs and provide Layer 3 isolation between segments over a shared physical fabric. Each VN maintains separate endpoint tables and routing domains while sharing the same underlay and border devices.

Question 46Network Access

Which Cisco ISE node persona is responsible for handling RADIUS authentication requests from network access devices?

  1. Policy Administration node
  2. Policy Service node Correct answer.
  3. Monitoring and Troubleshooting node
  4. pxGrid controller

Explanation

Policy Service nodes run the RADIUS and TACACS+ services that process authentication and authorization requests from NADs. The Policy Administration node manages configuration, and the Monitoring node collects logs and reports.

Question 47Network Access

An administrator configures a Cisco ISE authorization policy that assigns a dACL to endpoints in the BYOD group. Which attribute is most appropriate to match in the authorization rule?

  1. RADIUS shared secret
  2. Switch hostname
  3. Endpoint identity group Correct answer.
  4. Device interface description

Explanation

Endpoint identity groups are populated by profiling and can be referenced directly in authorization conditions to select a result such as a dACL. Matching on endpoint group keeps policy consistent across many network devices without per-port configuration.

Question 48Network Access

Which Cisco ISE feature allows a device to be profiled based on DHCP, CDP, and HTTP probe data collected by the network?

  1. Posture assessment
  2. Profiling with probe collection Correct answer.
  3. Guest sponsor portal
  4. TACACS+ command authorization

Explanation

ISE profiling collects attributes from probes such as DHCP, CDP, LLDP, NetFlow, and HTTP user agents to classify endpoints into identity groups. Profiling results then feed authorization policy decisions.

Question 49Network Access

A wireless client connects to a guest SSID and must be redirected to a registration portal before receiving internet access. Which ISE capability supports this workflow?

  1. Central web authentication with guest portal Correct answer.
  2. pxGrid endpoint purge
  3. EAP-TLS certificate authentication
  4. Change of authorization with dACL

Explanation

Central web authentication redirects the client to an ISE-hosted guest or BYOD portal where registration occurs before access is granted. After registration, ISE issues a CoA to apply the appropriate authorization result.

Question 50Network Access

Which protocol allows a Cisco switch to download a Security Group Tag mapping table from a TrustSec-capable peer when inline tagging is not supported?

  1. SXP Correct answer.
  2. TACACS+
  3. SNMP
  4. RADIUS

Explanation

SXP (SGT Exchange Protocol) propagates IP-to-SGT bindings to devices that cannot read inline tags. This allows older hardware to participate in group-based policy enforcement.