mediumMultiple SelectObjective-mapped
CCNP Practice Question: Which two statements about 802.1X port states and…
Which two statements about 802.1X port states and access control are true? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Before authentication, the switch port is in the unauthorized state and only allows EAPOL frames.
In 802.1X, the switch port starts in the unauthorized state, allowing only EAPOL traffic. After successful authentication, the port transitions to the authorized state, allowing normal traffic. Multi-auth mode allows multiple devices on the same port, each authenticated individually. The port does not become fully authorized before the client sends traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Before authentication, the switch port is in the unauthorized state and only allows EAPOL frames.
Why this is correct
Correct because the unauthorized state blocks all traffic except EAPOL, which is necessary for the authentication process.
- ✓
After successful 802.1X authentication, the port transitions to the authorized state and all traffic is permitted.
Why this is correct
Correct because successful authentication moves the port to the authorized state, allowing normal data traffic based on the configured access policy.
- ✗
In multi-auth mode, the port becomes authorized for all devices once the first device authenticates successfully.
Why it's wrong here
Incorrect because in multi-auth mode, each device must authenticate individually; the port does not become authorized for all devices after the first authentication.
- ✗
The port remains in the unauthorized state until the client sends data traffic.
Why it's wrong here
Incorrect because the port transitions to authorized state based on authentication success, not on data traffic. The client may send EAPOL frames, but data traffic is not required for authorization.
- ✗
802.1X can be configured on a Layer 3 interface to authenticate users before routing.
Why it's wrong here
Incorrect because 802.1X operates at Layer 2 and is configured on switch ports (Layer 2 interfaces), not on Layer 3 routed interfaces.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
One of 1,175 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.