350-401 Security Practice Question
A network administrator is configuring 802.1X authentication on a Cisco switch port. The port is connected to a VoIP phone that then connects to a PC. The administrator wants to authenticate both the phone and the PC separately, with the phone using MAB and the PC using 802.1X. Which feature should be configured on the switch port to support this?
⚠ Common exam trap
Many candidates confuse Multi-Auth with MDA; Multi-Auth allows multiple devices but does not separate voice and data domains as required for a VoIP phone and PC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Multi-Domain Authentication (MDA)
MDA is specifically designed to allow a voice device and a data device to authenticate separately on the same switch port. The phone can use MAB while the PC uses 802.1X, and they are placed in different VLANs. Multi-Auth and Multi-Host do not provide this voice/data separation, and WebAuth is a different authentication method. Thus, MDA is the correct feature.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Web Authentication (WebAuth)
Why it's wrong here
WebAuth is a fallback authentication method that uses a web portal for user authentication, typically for guest access. It does not provide the port-based, device-specific authentication needed for a VoIP phone and PC. While it can be used in conjunction with 802.1X, it does not enable separate authentication sessions for multiple devices on a single port. Therefore, it does not satisfy the scenario.
- ✓
Multi-Domain Authentication (MDA)
Why this is correct
MDA allows both a data device and a voice device to authenticate independently on the same switch port. It places the phone in the voice VLAN and the PC in the data VLAN, each with its own authentication session. This matches the requirement to authenticate the phone via MAB and the PC via 802.1X. MDA is designed for this exact scenario.
- ✗
Multi-Host
Why it's wrong here
Multi-Host mode allows multiple devices to connect to a single authenticated port, but only the first device authenticates and all subsequent devices inherit that authentication. It does not support separate authentication for each device, nor does it separate voice and data VLANs. This would not meet the requirement for independent authentication of the phone and PC, so it is incorrect.
- ✗
Multi-Auth
Why it's wrong here
Multi-Auth allows multiple devices to authenticate on the same port, but it does not separate them into voice and data domains. All devices share the same VLAN and authentication parameters. While it supports multiple hosts, it does not provide the distinct handling required for a VoIP phone and a PC, where the phone should be in the voice VLAN and the PC in the data VLAN. Thus, it is not the correct feature.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
VLANs and Spanning Tree Protocol Concepts
Key term
Cisco TrustSec
Cisco TrustSec is a security architecture that uses identity-based access control and encryption to protect network traffic, rather than relying only on IP addresses and VLANs.
Key term
802.1X Authentication
802.1X is a network access control protocol that prevents unauthorized devices from connecting to a wired or wireless network by requiring them to authenticate before gaining access.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.