Question 490 of 1,840
mediumMultiple SelectObjective-mapped
350-401 Practice Question: Which two statements about 802.1X authentication…
Which two statements about 802.1X authentication process are true? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The supplicant sends an EAPOL-Start frame to begin the authentication process.
In 802.1X, the supplicant (client) initiates the session by sending an EAPOL-Start, or the authenticator (switch) can send an EAP-Request/Identity to prompt the client. The RADIUS server is the authentication server that validates credentials and sends an EAP-Success or EAP-Failure. The authenticator does not perform the actual authentication; it only relays EAP frames.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The supplicant sends an EAPOL-Start frame to begin the authentication process.
Why this is correct
Correct because the supplicant (client) typically initiates 802.1X by sending an EAPOL-Start frame to the authenticator.
- ✗
The authenticator (switch) performs the actual authentication of the supplicant credentials.
Why it's wrong here
Incorrect because the authenticator does not authenticate; it relays EAP messages between the supplicant and the RADIUS server, which performs the authentication.
- ✓
The authentication server (RADIUS) sends an EAP-Success message after successful validation of credentials.
Why this is correct
Correct because the RADIUS server validates the supplicant's credentials and sends an EAP-Success (or EAP-Failure) to the authenticator, which forwards it to the supplicant.
- ✗
EAPOL frames are used only between the authentication server and the authenticator.
Why it's wrong here
Incorrect because EAPOL (EAP over LAN) frames are used between the supplicant and the authenticator, not between the authenticator and the RADIUS server (which uses RADIUS protocol).
- ✗
The authenticator places the port in the unauthorized state before authentication completes.
Why it's wrong here
Incorrect because the port is initially in the unauthorized state, but this is a default condition, not something the authenticator does 'before authentication completes'—the statement is ambiguous and not a key process step.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 18, 2026
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.