CCNP Infrastructure Practice Question
A network engineer is configuring a Cisco IOS switch with 802.1X authentication. The switch is connected to a Cisco IP phone, and a PC is connected to the phone's PC port. The engineer wants to authenticate both the phone and the PC using 802.1X. Which feature should be configured to allow both devices to authenticate on the same switch port?
⚠ Common exam trap
Watch out — candidates often confuse Multi-Auth with Multi-Domain Authentication; Multi-Auth allows multiple devices but does not separate voice and data domains, which is required for IP phones.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Multi-Domain Authentication (MDA)
Multi-Domain Authentication (MDA) is designed for scenarios where an IP phone and a PC are connected to the same switch port. It allows the phone to authenticate in the voice domain and the PC in the data domain, each with its own authentication method. This provides the necessary separation of traffic and authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
MAC Authentication Bypass (MAB)
Why it's wrong here
MAB is used as a fallback when a device does not support 802.1X. It uses the MAC address to authenticate the device. While it can be used for devices that do not support 802.1X, it does not provide the domain separation needed for both a phone and a PC. MAB alone would not allow both devices to authenticate in their respective domains.
- ✗
Multi-Auth
Why it's wrong here
Multi-Auth allows multiple devices to authenticate on the same port, but each device must authenticate individually. However, it does not support the specific scenario where a phone and PC are connected in a daisy-chain. Multi-Auth is typically used when multiple hosts connect to a single port via a hub, and each host authenticates separately. It does not handle the voice VLAN and data VLAN separation required for IP phones.
- ✓
Multi-Domain Authentication (MDA)
Why this is correct
Multi-Domain Authentication (MDA) allows both a data device (PC) and a voice device (IP phone) to authenticate on the same switch port. The phone authenticates in the voice domain, and the PC authenticates in the data domain. This is the correct feature for this scenario because it separates the authentication domains and supports the typical IP phone with a PC attached.
- ✗
Web Authentication (WebAuth)
Why it's wrong here
WebAuth is used to authenticate users via a web portal, typically for guest access. It is not used for authenticating IP phones and PCs on a switch port. It requires a browser and is not suitable for devices like phones that do not have a web browser. Therefore, it does not meet the requirement.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.