220-1102 Security Practice Question
A technician is securing a small office network. The technician wants to ensure that only authorized devices can connect to the wired network ports. Which security control should the technician implement?
⚠ Common exam trap
The 220-1102 exam often tests 802.1X versus MAC filtering by presenting a scenario where 'only authorized devices' is required, and candidates mistakenly choose MAC filtering because it seems simpler, but they overlook that MAC addresses can be trivially spoofed, making 802.1X the only secure option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
802.1X authentication
802.1X is a port-based authentication protocol that requires devices to authenticate before gaining network access. It uses an authentication server (e.g., RADIUS) to verify credentials, ensuring only authorized devices can connect to wired switch ports. This is the correct control for per-port device authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
MAC address filtering
Why it's wrong here
MAC address filtering implements an allowlist of hardware addresses on the switch, but those addresses are transmitted as plaintext in every frame and can be trivially sniffed and spoofed using software tools. It provides no cryptographic identity or user authentication, so a malicious device that clones a permitted MAC will pass the filter just as easily as the legitimate host. Thus, while it may deter casual misuse, it does not satisfy the requirement to ensure only authorized devices gain network access.
- ✓
802.1X authentication
Why this is correct
802.1X uses Extensible Authentication Protocol over LAN (EAPOL) to authenticate the supplicant against a RADIUS/TACACS+ server before the switch port is fully opened. The port remains in an unauthorized state, blocking all traffic except EAPOL frames, until successful authentication, and per-session keys can be derived to protect the connection. This gives port-based, identity-driven access control that directly enforces which devices are allowed onto the network.
- ✗
VLAN segmentation
Why it's wrong here
VLAN segmentation divides the network into separate broadcast domains at Layer 2, limiting traffic between different functional areas, but it does not verify who is plugging into a given access port. An unauthenticated attacker who connects to a wall jack is simply assigned to the VLAN configured on that port and gains all of that VLAN's access to servers and other hosts. Additionally, misconfigured trunk ports can enable VLAN hopping, further undermining any security benefit.
- ✗
Stateful firewall
Why it's wrong here
A stateful firewall tracks active TCP/UDP sessions and applies allow/deny rules based on packet state, source/destination addresses, and ports, but it operates at the network edge and is not a physical-port access control mechanism. It cannot tell whether the device sending frames is authorized; it only sees whether the traffic matches policy. Therefore, an unauthorized device that connects to an internal switch port can still send permissible traffic through the firewall, so this option does not secure the LAN at the access layer.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Physical Security: Locks, Cameras, Access Badges
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Remote Authentication Dial-in User Service
RADIUS is a network protocol that provides centralized authentication, authorization, and accounting for users trying to connect to a network service.
About these practice questions
One of 925 original 220-1102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.