CCNA Network Services and Security Practice Question
Exhibit
SW1#show authentication sessions interface GigabitEthernet0/1 details Interface: GigabitEthernet0/1 MAC Address: aaaa.bbbb.cccc IP Address: 192.168.1.100 Status: Authorized Domain: DATA Oper host mode: single-host Oper control dir: both Session timeout: N/A Common Session ID: 0A1234567890ABCDEF123456 Acct Session ID: 0x00000001 Handle: 0x00000001 Runnable methods list: Method State dot1x Authc Success SW1#show dot1x interface GigabitEthernet0/1 details Dot1x Info for GigabitEthernet0/1 ----------------------------- PAE = AUTHENTICATOR PortControl = AUTO PortStatus = AUTHORIZED ReAuthentication = Disabled QuietPeriod = 60 ServerTimeout = 30 SuppTimeout = 30 ReAuthMax = 2 MaxReq = 2 TxPeriod = 30 RateLimitPeriod = 0 SW1#show running-config interface GigabitEthernet0/1 Building configuration... Current configuration : 200 bytes ! interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 authentication port-control auto dot1x pae authenticator spanning-tree portfast end
A network administrator has configured 802.1X port-based authentication on a Cisco IOS-XE switch port connected to a single PC. The port is in the 'authorized' state, but the PC cannot reach any network resources beyond its directly connected switch. The switch is configured to use RADIUS for authentication. What is the most likely cause of this issue?
⚠ Common exam trap
Cisco often tests the distinction between authentication success and post-authentication authorization, tricking candidates into thinking that a successful 802.1X authentication automatically grants full network access, when in fact the RADIUS server must also return the correct VLAN assignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The RADIUS server is not returning a VLAN assignment, so the port remains in the default VLAN, but the PC needs to be in a different VLAN to reach resources.
The RADIUS server can return a VLAN assignment as part of the Access-Accept message (via RADIUS attribute 64 or 81). If the server does not send a VLAN, the port remains in the configured access VLAN (often VLAN 1). If the PC needs to be in a different VLAN to reach network resources, it will be isolated even though 802.1X authentication succeeded and the port is authorized.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The switchport is in access mode and not trunking, so the PC cannot reach other VLANs.
Why it's wrong here
Access ports carry traffic for a single VLAN; that's normal for an end-device connection. The PC is placed in VLAN 10, and access mode still allows it to communicate within that VLAN. Reaching resources in other VLANs requires inter-VLAN routing (a default gateway and SVI/router interface), not trunking. Trunking only applies when the attached device needs to tag frames with multiple VLAN IDs, which a typical PC does not request.
- ✓
The RADIUS server is not returning a VLAN assignment, so the port remains in the default VLAN, but the PC needs to be in a different VLAN to reach resources.
Why this is correct
The 'show authentication sessions' output does not show a VLAN assigned, meaning the RADIUS server did not include the VLAN attribute. The switch uses the configured access VLAN (10) by default. If the PC needs to be in a different VLAN to reach resources, this is the root cause.
- ✗
The switch is not configured with 'aaa new-model' and therefore AAA is not enabled.
Why it's wrong here
For 802.1X to function, the global 'aaa new-model' command must be enabled, but the command alone does not guarantee correct VLAN assignment. The 'show authentication sessions' output indicates the port is Authorized, proving that AAA and RADIUS authentication completed successfully. If 'aaa new-model' were absent, no EAP/RADIUS exchange would occur and the port would remain unauthorized. The root issue is not missing AAA but the RADIUS server failing to include a VLAN assignment attribute.
- ✗
The PC is not configured for 802.1X supplicant, so it cannot authenticate properly.
Why it's wrong here
A PC that lacks an 802.1X supplicant would never respond to the switch's EAP requests, leaving the port stuck in an unauthorized or unauthenticated state. The fact that the port is Authorized means the PC's supplicant successfully performed the 802.1X handshake and received a valid authentication result. Therefore, the supplicant is clearly configured and functioning. This option confuses an authentication success with a post-authentication VLAN problem.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The RADIUS server is not returning a VLAN assignment, so the port remains in the default VLAN, but the PC needs to be in a different VLAN to reach resources.Correct answer▾
Why this is correct
The 'show authentication sessions' output does not show a VLAN assigned, meaning the RADIUS server did not include the VLAN attribute. The switch uses the configured access VLAN (10) by default. If the PC needs to be in a different VLAN to reach resources, this is the root cause.
✗The switchport is in access mode and not trunking, so the PC cannot reach other VLANs.Wrong answer — click to see why▾
Why this is wrong here
Access mode is correct for a single PC; trunking is not needed for basic connectivity.
✗The switch is not configured with 'aaa new-model' and therefore AAA is not enabled.Wrong answer — click to see why▾
Why this is wrong here
AAA is functioning, as evidenced by successful authentication.
✗The PC is not configured for 802.1X supplicant, so it cannot authenticate properly.Wrong answer — click to see why▾
Why this is wrong here
The port status is 'Authorized', indicating successful authentication.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
802.1X
802.1X is a network access control standard that authenticates devices before they are allowed to connect to a wired or wireless network.
Key term
VLAN
A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they are on the same physical network segment, regardless of their actual physical location.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.