Chapter 6 of 6 · Cisco CCNP 350-701 SCOR
Network Access, Visibility, and Enforcement
ISE access control, 802.1X, CoA, exfiltration, XDR, SIEM, SOAR, Duo and Splunk.
- 6topics
- 31 minfast track
- 2diagrams and exhibits
- 15%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Identity and Secure Access Concepts, Device Compliance and Application ControlLearn ISE identity concepts: guest services, profiling, posture and BYOD, plus device compliance with MDM and how application…5 min
- 2Configuring 802.1X and MAB with Cisco ISEConfigure 802.1X and MAB on IOS XE switches with Cisco ISE: roles, EAP methods, port modes, authentication order, authorisation…Diagram6 min
- 3Network Access with Change of AuthorizationLearn how RADIUS CoA lets ISE change an active session with reauthenticate, port bounce and disconnect, and how to configure and…Diagram5 min
- 4Data Exfiltration Techniques and How to Detect ThemExplain data exfiltration techniques such as DNS tunneling, HTTPS, email, file transfer, ICMP, chat, NTP and cloud storage, and…5 min
- 5XDR, SIEM and SOAR with Cisco XDR and SplunkDescribe visibility and enforcement with telemetry, AI and ML, XDR, SIEM and SOAR, and how Cisco XDR and Splunk manage and…5 min
- 6Cisco Duo in a Zero Trust ArchitectureDescribe Cisco Duo in zero trust: MFA, Trust Monitor, Device Trust, health checks, Adaptive Access policies, single sign-on and…5 min
About this chapter
What this chapter covers
This chapter is about deciding who and what can use the network, watching what happens, and acting on what you see.
It starts with Cisco Identity Services Engine and the access control methods around it. It then moves to how attackers move data out, how platforms such as XDR, SIEM and SOAR give visibility, and how Duo extends zero trust to the login.
The pages follow the eight topics that the question bank uses for this chapter, and show commands for the right platform where the exam expects them.
How the topics fit together
The chapter follows a loop of identify, enforce, watch and respond.
The first three pages build the access control story. Identity and compliance concepts explain what ISE can know, 802.1X and MAB show how the switch enforces it, and Change of Authorization shows how the decision is updated while a session is live.
The next two pages are about visibility. Exfiltration techniques list the ways data leaves a network and the signs that give them away. XDR, SIEM and SOAR show how telemetry and machine learning turn into incidents and automated action, with Cisco XDR and Splunk as examples.
The last page covers Duo in a zero trust design, which protects logins with MFA, device health checks and adaptive policy.
ISE appears in several chapters of the exam. The posture and endpoint pages from the endpoint chapter connect directly to the identity concepts here.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Practise the switch commands in a lab, because the 802.1X and CoA settings are easy to get slightly wrong. For the platform pages, focus on what each product is for and how they work together.
Ready for more practice?
The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.