Cisco 350-401: Enterprise Security and Identity Services — Study Guide

By Laurynas Brazys · 15 August 2026 · #cisco #350-401 #certification #exam-prep #study-guide

Part of the Cisco CCNP Enterprise 350-401 ENCOR — Study Guide. Practice with verified answers in the Cisco exam hub, or take timed practice tests on ExamRoll.io.

Overview

Enterprise Security and Identity Services unify user, device, and workload trust with network controls to reduce attack surface and contain breaches. This domain spans core principles (Zero Trust, least privilege, defense in depth), identity-based access using AAA and 802.1X with Cisco ISE, scalable segmentation with TrustSec and Security Group Tags (SGTs), secure transport and management, and the operational telemetry and processes required for detection, response, and audit. Successful designs align controls to the data, identity, and control planes; use strong cryptography where it adds measurable risk reduction; and anticipate failure modes with explicit fallbacks and monitoring.

Principles and Architecture

• Zero Trust: Treat every request as untrusted, verify explicitly (user, device, posture, context), and assume breach. Replace implicit trust from location (inside vs outside) with identity, device health, and policy.
• Least privilege: Grant the minimum access needed. In practice, prefer role- or attribute-based policy over static network placement. Enforce at ingress and within the network to shrink the blast radius.
• Defense in depth: Layer controls—identity, segmentation, encryption, endpoint protection, and monitoring—so single control failure does not equal compromise. Validate that each layer provides unique value and is independently monitored.
• Segmentation strategy: Combine macro-segmentation (VRFs/VPNs, firewalls) to isolate domains with micro-segmentation (SGTs/SGACLs) to control east-west traffic within domains. Design for operational scale: central policy definition, distributed enforcement, minimal per-device state.
• Control-plane protection: Reserve and police control traffic to keep routing, switch control, and management resilient under load or attack.

Trade-offs:

• More granular policy increases policy objects and change management complexity. Use group-based policy to decouple identity from IP addressing.
• Encrypting everything may be costly and obscures telemetry; target encryption to links and flows with clear risk and compliance drivers, and use flow metadata for visibility.

Identity, AAA, and Access Control

AAA provides centralized authentication, authorization, and accounting for device administration and network access.

• TACACS+ vs RADIUS:

  • TACACS+ is preferred for device administration (exec and per-command authorization, full-packet encryption, independent authentication/authorization/accounting). Failure modes: mis-ordered method lists or unavailable TACACS+ can lock out administrators; implement local fallback with restrictive privileges.
  • RADIUS is preferred for network access (802.1X, VPN, wireless). It supports attributes for VLAN, downloadable ACLs (dACLs), SGTs, and session timeouts. Failure modes: shared secret mismatch, RADIUS attribute mis-mapping, fragmentation of large attribute sets.

• Role-based access:

  • Device administration: Use TACACS+ command sets and shell profiles to implement least privilege for operators, SREs, and auditors. Restrict high-risk commands (e.g., write, debug, tftp).
  • Network access: Map identities to roles using Cisco ISE, enforce authorization results using VLANs, dACLs, SGTs, and QoS markings.

• High availability and resilience:

  • Use multiple AAA servers with health monitoring and timeouts tuned for user experience (e.g., network-access RADIUS <2 s timeouts, 2–3 retries).
  • Prefer EAP-TLS for 802.1X to eliminate password attacks and improve device trust; automate certificate lifecycle.

Short examples (device admin and 802.1X):

• Device administration with TACACS+:
  • aaa new-model
  • tacacs server ISE1 address ipv4 10.10.10.10 key
  • aaa authentication login CONSOLE local
  • aaa authentication login VTY group tacacs+ local
  • aaa authorization exec VTY group tacacs+ local
  • line vty 0 4 login authentication VTY transport input ssh
• Network access with RADIUS and 802.1X/MAB:
  • radius server ISE-RAD address ipv4 10.10.20.20 auth-port 1812 acct-port 1813 key
  • aaa authentication dot1x default group radius
  • aaa authorization network default group radius
  • dot1x system-auth-control
  • interface GigabitEthernet1/0/10 switchport mode access authentication periodic authentication timer reauthenticate 3600 mab dot1x pae authenticator dot1x timeout tx-period 7 spanning-tree portfast

802.1X, MAB, ISE, and posture:

• 802.1X provides port-based access control using EAP. Prefer EAP-TLS (certificates) over PEAP/MSCHAPv2. Failure modes: supplicant misconfigurations, certificate expiration, MTU/EAP fragmentation; mitigate with onboarding portals and certificate lifecycle automation.
• MAB (MAC Authentication Bypass) is a fallback for non-802.1X devices (printers, IP phones). Pair with profiling and restricted access (quarantine dACL or SGT) due to MAC spoofing risk.
• Cisco ISE centralizes identity, policy, profiling, posture, and guest/BYOD:
  • Posture assessment (AnyConnect/agentless) dynamically enforces compliance (patch, AV status) using dACLs, SGTs, and change of authorization (CoA) to transition from quarantine to production access.
  • pxGrid shares identity and posture with firewalls, EDR, and SIEM to align network policy with endpoint risk.

Segmentation and Policy Enforcement

TrustSec and group-based policy:

• SGTs carry identity context in the network. Enforcement options:
  • SGACLs on switches/firewalls to allow/deny based on source/destination SGTs.
  • In SD-Access, SGTs ride in the VXLAN header; enforcement is scalable and decoupled from IP addressing.
• Benefits: Scale (policies per group pair vs per-IP), mobility (policy follows identity), and clear least-privilege matrices.
• Failure modes: SGT propagation gaps (SXP disabled, fabric edge not tagging), policy shadowing, TCAM exhaustion from mixed IP ACLs and SGACLs. Mitigate with centralized policy validation and capacity planning.

ACLs and classic controls:

• IP ACLs remain valuable for device-external traffic and control-plane filtering. Keep ACLs deterministic and summarize where possible.
• Control-plane policing (CoPP) protects routing, management, and HSRP/VRRP from floods. Start with vendor templates and tune cautiously; an over-aggressive CoPP can drop valid keepalives and flap adjacencies.
• Firewalls:
  • Use stateful firewalls or zone-based firewalls at macro boundaries; leverage application identification and identity context (via ISE pxGrid).
  • Align zones/VRFs to trust boundaries; prevent asymmetric routing that breaks state.
  • For east-west segmentation, combine SGT-based policy with firewall anchor points for high-risk flows.

Short TrustSec example (edge switch):

• cts role-based enforcement
• cts role-based sgt 20
• cts sxp enable

Secure Transport, Management, and Platform Integrity

Encryption selection:

• MACsec (802.1AE) secures L2 links with line-rate AES-GCM; ideal for campus access, uplinks, and fabric edges. Use MKA with 802.1X/EAP-TLS for key management; watch for negotiation mismatches and unsupported transceivers.
• IPsec secures L3 paths (site-to-site, remote access, SD-WAN underlay). Prefer IKEv2 with AES-GCM, PFS groups (e.g., 19/20), and modern lifetimes; account for MTU overhead and fragmentation risk.
• TLS for management and application transport; require strong ciphers and mutual auth where feasible.

Short examples:

• MACsec on an interface:
  • interface TenGigabitEthernet1/0/1 mka policy CAMPUS-MKA macsec
• IPsec IKEv2 proposal:
  • crypto ikev2 proposal SECURE encryption aes-gcm-256 prf sha256 group 20
• Secure management:
  • ip ssh version 2
  • ip ssh server algorithm encryption aes256-ctr aes128-ctr
  • ip http secure-server
  • ip http tls-version 1.2
  • snmp-server group SEC v3 priv
• NTP with authentication:
  • ntp authenticate
  • ntp authentication-key 1 md5
  • ntp trusted-key 1
  • ntp server 192.0.2.10 key 1

Certificates and PKI:

• Use enterprise PKI or ISE internal CA for EAP-TLS and device certificates. Enforce CRL/OCSP where supported. Automate renewal to avoid mass 802.1X outages.
• For device administration, bind SSH to host keys signed by CA where possible; avoid default keys and weak ciphers.

Platform integrity:

• Secure boot and image signing prevent tampering. Enable image verification at install, store golden images offline, and restrict ROMMON access. Validate file hashes pre- and post-upgrade. Failure modes: boot loops after integrity failure—plan staged rollbacks and out-of-band access.

Telemetry, Threat Detection, Logging, and Response

Endpoint protection and detection:

• Deploy EDR/AV with behavior analytics; integrate with ISE for adaptive network enforcement based on endpoint risk.
• Network detection sources: NetFlow/IPFIX, Encrypted Traffic Analytics, DNS logs, DHCP logs, WLC and ISE session logs, firewall and proxy logs, wireless RRM and RF health, control-plane counters, and device sensor profiling.

Telemetry design:

• Stream telemetry to a SIEM or data lake with reliable transport. Normalize identity context (user, device, SGT, IP, VLAN, AP switchport) for correlation.
• Time synchronization with authenticated NTP is mandatory for forensic accuracy.

Security logging and audit:

• Log authentication, authorization results, CoA events, administrative changes, policy downloads, crypto session states, and exception paths (MAB, guest).
• Preserve audit evidence with integrity controls, documented chain of custody, and retention aligned to regulation and incident response needs.

Incident response:

• Preparation: playbooks for account compromise, lateral movement, and rogue devices; test CoA and quarantine workflows.
• Detection and analysis: leverage baselines and anomaly detection; triage by identity and segment reachability, not only IP.
• Containment and eradication: use SGACLs/dACLs for immediate isolation; rotate credentials/keys; reimage or patch.
• Recovery: staged re-enablement based on clean posture; monitor for re-infection.
• Post-incident: gap analysis, control tuning (e.g., SGT coverage, CoPP thresholds), and training.

Common failure modes and remediation:

• Certificate expiry halts 802.1X/EAP-TLS: monitor expirations; enable auto-enrollment; maintain emergency MAB with restricted access.
• ISE or RADIUS outage: use redundant nodes, Anycast VIPs, carefully tuned timeouts, and local authorization fallback with minimal privilege.
• dACL or SGT policy mismatch: implement pre-change validation and shadow policy analysis; use canary endpoints.
• MACsec/IPsec MTU overhead: set MSS clamping and jumbo where supported; monitor DF bit drops.
• CoPP overblocking: start permissive and iterate with measured increments; use show control-plane counters regularly.
• SNMP/SSH weak settings: enforce SNMPv3 only and SSHv2 strong ciphers; disable legacy protocols.
• Logging overwhelm or gaps: rate-limit noisy facilities; ensure critical facilities are high priority and lossless; verify parser coverage in SIEM.

Practical Problem Scenario

Acme BioTech must implement identity-based access and micro-segmentation in its campus while protecting management and control planes and preparing for audits, without disrupting lab devices that lack supplicants.

1. Establish identity and AAA foundation

• Rationale: Centralized identity is prerequisite for least privilege. Deploy Cisco ISE with redundant nodes; integrate with AD and PKI. Configure TACACS+ for device admin and RADIUS for network access with EAP-TLS. This separates operator privileges from user/device authorization and eliminates password-based 802.1X attacks.

2. Phase in 802.1X with MAB fallback and posture

• Rationale: Start in low-impact mode to observe supplicant behavior. Enable 802.1X globally; on access ports, configure dot1x with MAB. Define ISE policies that place unknown devices into a quarantine SGT with a redirect ACL to a posture portal. Known corporate endpoints with valid EAP-TLS and healthy posture receive the “Employee” SGT. Lab devices identified via profiling (OUI, DHCP fingerprint) get a restricted “Lab-Equip” SGT. This supports non-802.1X endpoints while enforcing least privilege.

3. Implement TrustSec SGT propagation and SGACL enforcement

• Rationale: Use group-based policy matrices to define which roles talk (e.g., Employee to Finance-Apps allow TCP 443; Lab-Equip deny to HR). Enable CTS role-based enforcement on distribution and access switches, and ensure SGT propagation via SXP or fabric. This decouples policy from addressing and scales across VLAN changes or endpoint mobility.

4. Harden control and management planes

• Rationale: Prevent network instability and compromise. Apply CoPP with cautious rate limits for routing, STP, HSRP, and management protocols, adjusting after baseline observation. Enforce SSHv2 with strong ciphers, disable HTTP, enable HTTPS TLS 1.2+, and restrict management access with AAA-based authorization and a management VRF. Configure SNMPv3 authPriv and authenticated NTP to ensure accurate logs.

5. Protect data in motion where risk warrants

• Rationale: Encrypt high-risk links without unnecessary overhead. Enable MACsec on access and distribution uplinks to prevent local tapping. For WAN or untrusted campus interconnects, deploy IKEv2 IPsec with AES-GCM and PFS. Validate MTU and enable MSS clamping to avoid fragmentation-induced application issues.

6. Deploy telemetry and integrate for detection and audit

• Rationale: Visibility drives response and proof. Stream NetFlow/IPFIX, syslog, ISE Live Logs, and firewall events to the SIEM. Enable device sensor and profiling exports from switches to ISE. Implement EDR on endpoints and integrate via pxGrid to quarantine compromised hosts automatically using CoA. Configure log retention and integrity checks to meet audit requirements.

7. Validate, monitor, and iterate

• Rationale: Reduce outage risk and close gaps. Use pilot access closets with canary endpoints to validate SGT assignments and SGACLs. Monitor authentication success rates, CoA events, and CoPP drops. Create alerts for certificate expiration and AAA latency. Document rollback procedures and maintain an emergency VLAN/SGT for safe fallback in case of posture or ISE outage.

By following these steps, Acme BioTech achieves Zero Trust-aligned, identity-based access with scalable segmentation, protected control and management planes, encrypted high-risk links, and the telemetry and processes necessary for rapid incident response and audit readiness.

← WAN · All domains · Automation →

Practice these questions → · Timed practice on ExamRoll.io →