Match each 802.1X component to its role.
Drag a concept onto its matching description — or click a concept then click the description.
Client requesting network access
Network device that enforces access control
RADIUS server that validates credentials
Extensible Authentication Protocol framework
Protocol used for AAA services
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Supplicant: End user device that requests access
In 802.1X, the supplicant is the client requesting access, the authenticator is the network device (switch/AP) that enforces access control, and the authentication server (RADIUS) validates credentials. Common confusions involve swapping the roles of supplicant and authenticator.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Supplicant: End user device that requests access
Why this is correct
The supplicant is the client software on the end device that initiates authentication.
Authenticator: Network device that relays authentication messages and controls port state
Why this is correct
The authenticator (typically a switch or AP) forwards EAP messages between supplicant and authentication server, and changes port state based on authorization.
Authentication Server: Server that validates credentials and authorizes access
Why this is correct
The authentication server (usually a RADIUS server) verifies credentials and tells the authenticator whether to grant access.
Supplicant: Device that enforces access control and grants access
Why it's wrong here
Incorrect — this describes the authenticator, not the supplicant.
Authenticator: End user device that requests authentication
Why it's wrong here
Incorrect — this describes the supplicant, not the authenticator.
Quick reference
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.