CCNA Network Services and Security Practice Question
A switchport is configured for 802.1X authentication. What is the usual role of the RADIUS server in that design?
⚠ Common exam trap
A common exam trap is assuming the RADIUS server handles functions beyond authentication, such as DHCP IP address assignment or ARP gateway replies. Candidates might mistakenly believe that RADIUS negotiates switchport trunking or manages Layer 2 connectivity, which it does not. This confusion often arises because RADIUS is involved in network access control but does not replace other network services. Misunderstanding these roles can lead to selecting incorrect options that describe unrelated network functions, causing errors in the exam.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It validates authentication credentials for the supplicant.
The switch acts as the authenticator and forwards authentication requests to the RADIUS server, which validates the user or device credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It provides Layer 2 trunk negotiation for the supplicant.
Why it's wrong here
Trunk links are negotiated between adjacent switches using Dynamic Trunking Protocol (DTP) or manually configured with switchport modes; RADIUS has no mechanism for this function. On an 802.1X port, the switch is a port access entity that only relays authentication traffic. While a RADIUS server can return authorization attributes such as VLAN assignment after authentication, it never establishes or negotiates Layer 2 trunking for the supplicant.
When this WOULD be correct
If the question were about a switchport configured for VLAN trunking and the role of a protocol like DTP (Dynamic Trunking Protocol) in negotiating trunk links, then this option could be correct. In that context, the switchport would indeed negotiate trunk settings with the connected device.
- ✓
It validates authentication credentials for the supplicant.
Why this is correct
In an 802.1X deployment, the switch acts as the authenticator and forwards EAP frames from the supplicant to the RADIUS server. The server performs the actual authentication decision by checking the presented credentials (EAP-TLS, PEAP-MSCHAPv2, etc.) against an identity store, then returns Access-Accept, Access-Reject, or Access-Challenge. This centralized AAA role is what makes RADIUS the logical validation point for the supplicant's credentials.
- ✗
It replaces the need for DHCP on the access layer.
Why it's wrong here
DHCP is the protocol that assigns IP configuration such as address, subnet mask, and gateway to a host, while RADIUS only processes authentication requests. Even after 802.1X authenticates a device and assigns a VLAN via RADIUS attributes, the device still needs DHCP (or static IP) to participate on the network. The two protocols operate at different layers and solve separate problems, so RADIUS cannot substitute for DHCP's address-allocation role.
When this WOULD be correct
In a different context, a question might ask about the role of a server in a network where DHCP is integrated with RADIUS for IP address assignment. If the question specified a DHCP server that also performs RADIUS functions, this option could be correct.
- ✗
It generates ARP replies on behalf of the default gateway.
Why it's wrong here
RADIUS servers authenticate devices and users; they do not participate in Layer 2 address resolution. ARP is used by end hosts to map a next-hop IP to a MAC address, and the default gateway itself responds to ARP requests. The switchport's 802.1X authenticator sends RADIUS Access-Request packets, not ARP frames, so the server never answers for the gateway.
When this WOULD be correct
In a different context, if the question were about a network device that acts as a proxy for ARP requests in an environment where the default gateway is not directly reachable, then this option could be correct. For example, a question about a device that performs ARP proxying in a segmented network could validate this statement.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓It validates authentication credentials for the supplicant.Correct answer▾
Why this is correct
In an 802.1X deployment, the switch acts as the authenticator and forwards EAP frames from the supplicant to the RADIUS server. The server performs the actual authentication decision by checking the presented credentials (EAP-TLS, PEAP-MSCHAPv2, etc.) against an identity store, then returns Access-Accept, Access-Reject, or Access-Challenge. This centralized AAA role is what makes RADIUS the logical validation point for the supplicant's credentials.
✗It provides Layer 2 trunk negotiation for the supplicant.Wrong answer — click to see why▾
Why this is wrong here
RADIUS is an AAA protocol used for authentication, authorization, and accounting, not for Layer 2 trunk negotiation. Trunk negotiation is handled by protocols like DTP or manually configured.
★ When this WOULD be the correct answer
If the question were about a switchport configured for VLAN trunking and the role of a protocol like DTP (Dynamic Trunking Protocol) in negotiating trunk links, then this option could be correct. In that context, the switchport would indeed negotiate trunk settings with the connected device.
Why candidates choose this
Students may confuse RADIUS with protocols that manage switchport behavior, or think that because RADIUS is involved in network access, it also controls trunking.
✗It replaces the need for DHCP on the access layer.Wrong answer — click to see why▾
Why this is wrong here
RADIUS and DHCP serve entirely different purposes. DHCP assigns IP addresses and other network parameters, while RADIUS handles authentication and authorization. RADIUS does not replace DHCP.
★ When this WOULD be the correct answer
In a different context, a question might ask about the role of a server in a network where DHCP is integrated with RADIUS for IP address assignment. If the question specified a DHCP server that also performs RADIUS functions, this option could be correct.
Why candidates choose this
Both RADIUS and DHCP are network services that can be integrated (e.g., RADIUS can return attributes used by DHCP), leading some to mistakenly think RADIUS can replace DHCP.
✗It generates ARP replies on behalf of the default gateway.Wrong answer — click to see why▾
Why this is wrong here
RADIUS does not generate ARP replies. ARP is a Layer 2 protocol used for IP-to-MAC address resolution, typically handled by routers or hosts. RADIUS operates at the application layer for AAA services.
★ When this WOULD be the correct answer
In a different context, if the question were about a network device that acts as a proxy for ARP requests in an environment where the default gateway is not directly reachable, then this option could be correct. For example, a question about a device that performs ARP proxying in a segmented network could validate this statement.
Why candidates choose this
In some network designs, RADIUS can be used in conjunction with other features like ARP inspection, but it does not directly generate ARP replies. This confusion may arise from the broad role of RADIUS in network access control.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
Key term
Switchport
A switchport is a physical or virtual interface on a network switch that connects devices like computers, printers, or other switches to a local area network.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.