Introduction to 802.1X Operations for Cisco Security Professionals Exam (S802DT1X) (650-472) Free Practice Test

Question 1

Which Cisco Catalyst Switch command enables 802.1X authentication globally?

A. dot1x pae authenticator

B. authentication order dot1x mab

C. dot1x system-auth-control

D. aaa new-model

E. authentication priority dot1x mab

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

In which OSI layer does EAP operate?

A. Layer 2 (data Link)

B. Layer 3 (network)

C. Layer 4 (transport)

D. Layer 1 (physical)

E. Layer 7 (application)

Correct Answer: A

Question 3

Which Cisco TrustSec device performs user authenticated?

A. RADIUS

B. EAP

C. supplicant

D. authentication server

E. authenticator

Correct Answer: D

Question 4

Which two statements are true regarding communication from the authenticator to the authentication server (Cisco ISE)? (Choose two.)

A. EAP messages are sent encapsulated in RADIUS protocol over UDP port 1646.

B. EAP messages are sent to the RADIUS server over UDP port 1812.

C. EAP messages are sent to the RADIUS server over UDP port 1645.

D. EAP messages are sent encapsulated in RADIUS protocol over UDP port 1645.

E. EAP messages are sent to the RADIUS server over UDP port 1646.

F. EAP messages are sent encapsulated in RADIUS protocol over UDP port 1812.

Correct Answer: D,F

Question 5

Which three statements about hosts moving from port to port on the same switch that is configured for 802.1X are true? (Choose three.)

A. The 3k-access(config)# authentication mac-move permit command can be used to allow a host to disconnect from an IP phone that is not manufactured by Cisco and authenticate on a different port on the same switch.

B. The 3k-access(config-if)# authentication violation replace command can be used to allow a new host to authenticate to an IP phone that is not manufactured by Cisco.

C. The 3k-access(config)# authentication mac-move permit command can be used to allow a new host to authenticate to an IP phone that is not manufactured by Cisco Cisco IP phones use Cisco Discovery Protocol to signal to the Cisco Catalyst switch that the tethered PC has disconnected.

D. The 3k-access(config-if)# authentication violation replace command can be used to allow a host to disconnect from an IP phone that is not manufactured by Cisco and authenticate on a different port on the same switch.

E. Cisco IP phones send a RADIUS packet with Cisco-av-pair UCPort= Disco to signal to the Cisco Catalyst switch that the tethered PC has disconnected.

Correct Answer: A,B,E

Question 6

Which two EAP methods are examples of challenge-response methods? (Choose two.)

A. EAP-MD5

B. EAP-FAST

C. PEAP

D. EAP-TLS

E. LEAP

Correct Answer: A,E

Question 7

Which statement is true for certificate auto-enrollment on a Cisco IP phone?

A. Cisco IP phones are capable of using digital certificates, but manual enrollment is required.

B. Microsoft Windows 2008 Enterprise Certificate Server Telephony plug-in can be used for auto-enrolling certificates.

C. Cisco Unified Communications Manager Certificate Auto-Enroll Function (CAEF) is capable of auto-enrolling certificates.

D. Microsoft Windows 2003 Certificate Server Telephony plug-in can be used for auto-enrolling certificates.

E. Cisco IP phones are not capable of using digital certificates.

F. Cisco Unified Communications Manager CA Proxy Function (CAPF) is capable of auto-enrolling certificates.

Correct Answer: F

Welcome to TestSimulate

Cisco Introduction to 802.1X Operations for Cisco Security Professionals Exam (S802DT1X) (650-472) Free Practice Test