CCNP Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable MAB (MAC Authentication Bypass) on the port.

  Why this is correct

  MAB allows devices that do not support 802.1X to authenticate using their MAC address. When MAB is enabled, the switch sends the device's MAC address to the RADIUS server (ISE) as username and password. If the MAC address is known, the device can be authorized and assigned to a VLAN, such as a guest VLAN. This is the standard method to support non-supplicant devices.

• ✗

  Configure the port as a trunk port with native VLAN set to the guest VLAN.

  Why it's wrong here

  Configuring a trunk port with a native VLAN does not provide authentication or dynamic VLAN assignment. It would allow untagged traffic on the native VLAN, but it does not distinguish between authenticated and unauthenticated devices. This approach bypasses 802.1X entirely and does not integrate with ISE for authorization, failing to meet the security requirements.

• ✗

  Set the port to force-authorized mode.

  Why it's wrong here

  Force-authorized mode places the port in an authorized state without any authentication, effectively disabling 802.1X. All devices connecting to the port would be allowed access, but they would not be assigned to a specific VLAN based on identity. This does not provide the desired guest VLAN assignment for non-supplicant devices and weakens security.

• ✗

  Configure the port as a multi-auth port with an authentication open mode.

  Why it's wrong here

  Multi-auth allows multiple devices to authenticate on a single port, but it does not automatically assign non-supplicant devices to a guest VLAN. Authentication open mode allows traffic before authentication, but it does not direct non-802.1X devices to a specific VLAN. This combination would not meet the requirement of placing non-supplicant devices into a guest VLAN.