CCNP Security Practice Question
A network administrator is configuring 802.1X on a Cisco Catalyst switch. The switch is connected to a Cisco IP phone with a PC attached to the phone's data port. The requirement is to authenticate both the phone and the PC separately, with the phone in the voice VLAN and the PC in the data VLAN. Which 802.1X feature should be enabled?
⚠ Common exam trap
Candidates often confuse Multi-Auth with MDA; Multi-Auth allows multiple devices but places them in the same VLAN, while MDA separates voice and data domains.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Multi-Domain Authentication (MDA)
Multi-Domain Authentication (MDA) is designed for scenarios where a voice device and a data device share a switch port. It allows both to authenticate independently and assigns them to their respective VLANs, meeting the requirement for separate authentication and VLAN segmentation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Multi-Authentication (Multi-Auth)
Why it's wrong here
Multi-Auth allows multiple devices to authenticate on the same port, but all devices are placed in the same VLAN (the data VLAN). It does not separate voice and data VLANs. While it supports multiple authentications, it does not provide the VLAN segmentation required for the phone and PC.
- ✗
MAC Authentication Bypass (MAB)
Why it's wrong here
MAB is a fallback authentication method for devices that do not support 802.1X, using their MAC address. It does not provide separate authentication for multiple devices on the same port. While it can be used for the phone, it does not meet the requirement for separate authentication of both devices.
- ✓
Multi-Domain Authentication (MDA)
Why this is correct
MDA allows both a voice device (phone) and a data device (PC) to authenticate independently on the same switch port. Each device is authenticated in its respective VLAN (voice and data), and the switch applies separate policies. This meets the requirement of authenticating both devices separately.
- ✗
Web Authentication (WebAuth)
Why it's wrong here
WebAuth is used for guest access and requires users to authenticate via a web portal. It does not support separate authentication for voice and data devices on the same port. It is not suitable for authenticating an IP phone and a PC with distinct VLAN assignments.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.