CCNP Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  dot1x pae authenticator

  Why it's wrong here

  The command sets the Port Access Entity (PAE) role to authenticator, which is necessary for the switch to act as the 802.1X authenticator, but it does not actually enable port-based authentication on the interface. Without 'authentication port-control auto', the port remains in its default state (force-authorized), so the command alone does not enforce 802.1X. It is a prerequisite, not the enabling command.

• ✓

  authentication port-control auto

  Why this is correct

  This command sets the port's authentication mode to auto, meaning the port will be unauthorized until the client successfully authenticates via 802.1X. It triggers the authentication process and is the required command to enable 802.1X on an interface. This is the correct answer because it directly controls the port's state based on authentication.

• ✗

  authentication port-control force-authorized

  Why it's wrong here

  This command disables 802.1X on the port by forcing it to the authorized state without requiring any authentication. All traffic is allowed without checking credentials, which defeats the purpose of 802.1X. It is the default for ports that do not have authentication configured, making it the opposite of what is needed.

• ✗

  authentication port-control force-unauthorized

  Why it's wrong here

  This command forces the port to an unauthorized state, blocking all traffic regardless of authentication. While it does restrict access, it does not allow for any authentication process to succeed, so it cannot be used to implement 802.1X. It would shut down the port completely, not provide the dynamic authentication behavior required.