350-401 Security Practice Question
A network administrator is deploying 802.1X on Cisco Catalyst switches with Cisco ISE as the RADIUS server. The administrator wants to allow devices that do not support 802.1X, such as printers, to connect to the network. Which feature should be configured on the switch ports to support these devices while maintaining security?
⚠ Common exam trap
Test-takers frequently confuse the roles of supplicant, authenticator, and authentication server, and assuming the switch can authenticate on behalf of endpoints without MAB.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable MAC Authentication Bypass (MAB) on the switch ports so that the MAC address of non-802.1X devices is sent to ISE for authentication.
MAC Authentication Bypass allows devices that lack 802.1X supplicant software to be authenticated by their MAC address against Cisco ISE. The switch sends the MAC address as both username and password, and ISE applies the appropriate authorization policy. This enables printers and similar devices to connect while still enforcing centralized access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the switch ports as 802.1X supplicants so they can authenticate on behalf of connected devices.
Why it's wrong here
Switches act as authenticators, not supplicants, in 802.1X. A supplicant is the endpoint device requesting access. Configuring the switch port as a supplicant would not help non-802.1X devices authenticate; it would instead make the switch attempt to authenticate itself to an upstream authenticator, which is not the goal here.
- ✓
Enable MAC Authentication Bypass (MAB) on the switch ports so that the MAC address of non-802.1X devices is sent to ISE for authentication.
Why this is correct
MAB allows non-802.1X-capable devices like printers to be authenticated by their MAC address. The switch learns the MAC address and sends it to ISE as the username and password. ISE can then apply an authorization policy, such as placing the device in a specific VLAN or applying an ACL. This maintains centralized control while supporting legacy devices.
- ✗
Implement 802.1X with EAP-TLS and install certificates on the printers.
Why it's wrong here
Printers typically do not support 802.1X supplicant functionality or certificate-based EAP-TLS authentication. Installing certificates on printers is often not feasible due to limited management interfaces and processing capabilities. EAP-TLS requires a supplicant, which these devices lack, so this option does not solve the problem of supporting non-802.1X devices.
- ✗
Disable 802.1X on the ports and rely on port security to restrict access based on MAC addresses.
Why it's wrong here
Disabling 802.1X removes the centralized authentication and authorization provided by ISE, reducing security. Port security only limits the number of MAC addresses allowed on a port and does not authenticate devices against a policy server. This approach would not integrate with the existing 802.1X deployment and would fail to apply dynamic authorization policies.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Spine-Leaf and Software-Defined Network Architectures
Key term
802.1X Authentication
802.1X is a network access control protocol that prevents unauthorized devices from connecting to a wired or wireless network by requiring them to authenticate before gaining access.
Key term
Cisco ISE
Cisco Identity Services Engine is a security policy management platform that controls who can access a network and what they can do once connected.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.