hardMultiple SelectObjective-mapped
350-401 Practice Question: Which three statements about 802.1X port-based…
Which three statements about 802.1X port-based authentication are true? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The supplicant communicates with the authenticator using EAP over LAN (EAPoL) frames.
802.1X uses EAP over LAN (EAPoL) for communication between supplicant and authenticator, the authenticator is typically a switch, and the authentication server is usually a RADIUS server. Option A is correct because EAPoL is the protocol used. Option B is correct because the switch acts as the authenticator. Option D is correct because the authentication server is typically RADIUS. Option C is incorrect because the supplicant is the client, not the switch. Option E is incorrect because 802.1X can be used with both wired and wireless networks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The supplicant communicates with the authenticator using EAP over LAN (EAPoL) frames.
Why this is correct
Correct; EAPoL is the encapsulation used for 802.1X on wired LANs.
- ✓
The authenticator is typically a network switch or wireless access point.
Why this is correct
Correct; the authenticator enforces access control and relays EAP messages.
- ✗
The supplicant is the device that provides authentication services, such as a RADIUS server.
Why it's wrong here
Incorrect; the supplicant is the client requesting access, not the authentication server.
- ✓
The authentication server is usually a RADIUS server that validates credentials.
Why this is correct
Correct; RADIUS is the standard protocol for 802.1X authentication servers.
- ✗
802.1X is only supported on wireless networks and cannot be used on wired switches.
Why it's wrong here
Incorrect; 802.1X is widely used on both wired and wireless networks.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
VLANs and Spanning Tree Protocol Concepts
Key term
802.1X Authentication
802.1X is a network access control protocol that prevents unauthorized devices from connecting to a wired or wireless network by requiring them to authenticate before gaining access.
Key term
Cisco ISE
Cisco Identity Services Engine is a security policy management platform that controls who can access a network and what they can do once connected.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,175 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.