CCNP Practice Question: Which two statements about 802.1X authentication…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The supplicant sends an EAPOL-Start frame to begin the authentication process.

  Why this is correct

  Correct because the supplicant (client) typically initiates 802.1X by sending an EAPOL-Start frame to the authenticator.

• ✗

  The authenticator (switch) performs the actual authentication of the supplicant credentials.

  Why it's wrong here

  Incorrect because the authenticator does not authenticate; it relays EAP messages between the supplicant and the RADIUS server, which performs the authentication.

• ✓

  The authentication server (RADIUS) sends an EAP-Success message after successful validation of credentials.

  Why this is correct

  Correct because the RADIUS server validates the supplicant's credentials and sends an EAP-Success (or EAP-Failure) to the authenticator, which forwards it to the supplicant.

• ✗

  EAPOL frames are used only between the authentication server and the authenticator.

  Why it's wrong here

  Incorrect because EAPOL (EAP over LAN) frames are used between the supplicant and the authenticator, not between the authenticator and the RADIUS server (which uses RADIUS protocol).

• ✗

  The authenticator places the port in the unauthorized state before authentication completes.

  Why it's wrong here

  Incorrect because the port is initially in the unauthorized state, but this is a default condition, not something the authenticator does 'before authentication completes'—the statement is ambiguous and not a key process step.