CCNA Network Services and Security Practice Question
Exhibit
Switch# show running-config interface GigabitEthernet1/0/1
Building configuration...
Current configuration : 250 bytes
!
interface GigabitEthernet1/0/1
switchport mode access
switchport access vlan 10
authentication port-control auto
authentication periodic
authentication timer reauthenticate 3600
dot1x pae authenticator
dot1x timeout tx-period 3
spanning-tree portfast
end
Switch# show authentication sessions interface GigabitEthernet1/0/1 details
Interface: GigabitEthernet1/0/1
MAC Address: aaaa.bbbb.cccc
IP Address: 192.168.10.25
User-Name: host/workstation
Status: Authz Success
Domain: DATA
Oper host mode: single-host
Oper control dir: both
Session timeout: 3600s
Common Session ID: 0A1B2C3D4E5F6G7H8I9J0K
Acct Session ID: 0x00000001
Handle: 0x00000001
Runnable methods list:
Method State
dot1x Authz Success
Switch# show dot1x all details
Sysauthcontrol ENABLED
Dot1x Protocol Version 3
Supplicant aaaa.bbbb.cccc, GigabitEthernet1/0/1
PAE = AUTHENTICATOR
quietPeriod = 60
serverTimeout = 30
maxReq = 2
reAuthMax = 2
allowAuthOn = [all]
startPeriod = 30
handshakePeriod = 15
txPeriod = 3
guestVlan = 999
authVlan = 100
criticalVlan = 200
hostMode = SINGLE_HOST
port-control = AUTO
control-direction = BOTH
host-auth = [success]
re-authentication = ENABLED
re-authperiod = 3600
server-timeout = 30
supp-timeout = 30
server-retries = 2
supp-retries = 2
max-reauth-req = 2
lastrx = 0
cap = 0
status = AUTHORIZED
state = HELD
backend-state = HELD
method = dot1x
timeout = 30A network administrator has configured 802.1X port-based authentication on a Cisco IOS-XE switch for a new access port connected to a user workstation. The workstation is failing to gain network access. The switch port is in the 'authorized' state, but the workstation cannot ping the default gateway. The administrator checks the running configuration and the authentication session details. What is the most likely cause of the issue?
⚠ Common exam trap
Cisco often tests the distinction between authentication success (port state 'authorized') and network connectivity success (correct VLAN assignment), tricking candidates into focusing on authentication failures when the real issue is a post-authentication VLAN misconfiguration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The RADIUS server returned a VLAN ID that placed the port in a VLAN lacking connectivity to the default gateway, such as a VLAN without an SVI or incorrect subnet assignment.
The switch port is in the 'authorized' state, indicating that 802.1X authentication succeeded and the RADIUS server sent an Access-Accept. However, the workstation cannot ping the default gateway, pointing to a connectivity issue after authentication. The most likely cause is that the RADIUS server returned a VLAN assignment (via the Tunnel-Private-Group-ID attribute) that placed the port in a VLAN that is not the intended one, such as a management VLAN without a gateway, or a VLAN missing a routed SVI, leaving the workstation isolated despite successful authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The RADIUS server has not been configured with the correct shared secret, causing authentication to fail silently.
Why it's wrong here
If the RADIUS shared secret were incorrect, the switch would receive no valid Access-Accept, and the authentication session would remain unauthorized or fall back to a non-authenticated state. The 'show authentication sessions' output displaying 'Authz Success' proves that the RADIUS exchange succeeded and the switch applied the returned authorization attributes, so a silent shared-secret mismatch is impossible. In a real shared-secret mismatch, the switch would typically log a RADIUS server unreachable or authentication failure event, and the port would stay in the 'unauthorized' state.
- ✓
The RADIUS server returned a VLAN ID that placed the port in a VLAN lacking connectivity to the default gateway, such as a VLAN without an SVI or incorrect subnet assignment.
Why this is correct
After successful 802.1X authentication, the switch can dynamically assign the port to a VLAN specified in the RADIUS Access-Accept message. If that VLAN exists but is not the correct user VLAN—for example, a dead-end VLAN or a VLAN where the default gateway IP is not configured or reachable—the device will appear authorized but will be unable to reach the gateway, exactly matching the symptoms.
- ✗
The switch port is in 'err-disabled' state due to a port-security violation, preventing any traffic.
Why it's wrong here
The port status in the authentication session output is 'AUTHORIZED' with 'Authz Success,' which directly contradicts an err-disabled state. An err-disabled port would not process 802.1X at all and would display 'err-disabled' with a reason such as 'psecure-violation' in the interface status. Since the session successfully completed and the port is forwarding, no port-security violation is blocking traffic.
- ✗
The workstation's supplicant is not configured with the correct EAP method, causing the authentication to use the guest VLAN instead.
Why it's wrong here
The output shows 'authVlan = 100' and the session is authorized with 'method = dot1x' and 'status = AUTHORIZED'. This indicates the supplicant successfully authenticated and was placed in the auth VLAN, not the guest VLAN.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The RADIUS server returned a VLAN ID that placed the port in a VLAN lacking connectivity to the default gateway, such as a VLAN without an SVI or incorrect subnet assignment.Correct answer▾
Why this is correct
After successful 802.1X authentication, the switch can dynamically assign the port to a VLAN specified in the RADIUS Access-Accept message. If that VLAN exists but is not the correct user VLAN—for example, a dead-end VLAN or a VLAN where the default gateway IP is not configured or reachable—the device will appear authorized but will be unable to reach the gateway, exactly matching the symptoms.
✗The RADIUS server has not been configured with the correct shared secret, causing authentication to fail silently.Wrong answer — click to see why▾
Why this is wrong here
The show authentication sessions output indicates 'Authz Success', meaning authentication and authorization succeeded. A shared secret mismatch would cause authentication failure, not a successful authorization.
Why candidates choose this
Students often confuse shared secret issues with other RADIUS configuration problems, but the authentication success message rules this out.
✗The switch port is in 'err-disabled' state due to a port-security violation, preventing any traffic.Wrong answer — click to see why▾
Why this is wrong here
The show command output clearly shows the port status as 'AUTHORIZED' and 'Authz Success'. There is no indication of err-disable. Port-security violations would show a different status, such as 'err-disabled' or 'security-violation'.
Why candidates choose this
Port security violations are a common cause of connectivity issues, and students may assume any access problem is due to err-disable without checking the port status.
✗The workstation's supplicant is not configured with the correct EAP method, causing the authentication to use the guest VLAN instead.Wrong answer — click to see why▾
Why this is wrong here
The output shows 'authVlan = 100' and the session is authorized with 'method = dot1x' and 'status = AUTHORIZED'. This indicates the supplicant successfully authenticated and was placed in the auth VLAN, not the guest VLAN. If the supplicant had failed, the port would be in the guest VLAN.
Why candidates choose this
Students may think that EAP method mismatch leads to guest VLAN usage, but the authorization success shows the supplicant authenticated correctly.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
RADIUS
RADIUS is a network protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service.
Key term
Management VLAN
A Management VLAN is a dedicated virtual local area network used to secure and separate administrative access to network devices like switches and routers from regular user data traffic.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.