220-1101 Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Port security

  Why it's wrong here

  Port security is a Layer 2 switch feature that limits the number of source MAC addresses allowed on an interface and can pin allowed addresses using sticky learning. However, this is an administrative access control based on unauthenticated MAC identifiers, and an attacker can trivially spoof a whitelisted MAC address in software. It does not verify the device's identity or require credentials, so it provides weak security compared with an authentication protocol.

• ✓

  802.1X

  Why this is correct

  802.1X is a port-based Network Access Control standard that requires a supplicant (the client), an authenticator (the switch or access point), and an authentication server (typically RADIUS) to run EAP methods such as EAP-TLS or PEAP. Before the LAN or WLAN port is fully opened, the device must present valid credentials or a certificate, thereby authenticating the connecting device rather than merely checking its hardware address. If authentication fails, the port remains in an unauthorized state, blocking all other traffic. This gives a far stronger protection against rogue endpoints than MAC-based techniques.

• ✗

  DHCP snooping

  Why it's wrong here

  DHCP snooping is a switch feature that monitors DHCP traffic and builds a binding table mapping client MAC addresses to IP addresses and ports, using trusted and untrusted port designations to drop messages from rogue DHCP servers. It is effective at preventing DHCP-based attacks such as DHCP starvation and IP address spoofing, but it never asks the client to prove its identity. The client authenticates itself only to the DHCP server via the DHCP protocol, which is unsecured, so DHCP snooping cannot prevent an unauthorized device from simply sending its own DHCP request and joining the network.

• ✗

  MAC address filtering

  Why it's wrong here

  MAC address filtering involves configuring an access point or router with an allowlist (or denylist) of client MAC addresses that are permitted to associate. Since the wireless medium broadcasts frames in the air, an attacker can passively capture a valid client's MAC and then change their own interface's MAC to impersonate that device, bypassing the filter entirely. This method also imposes administrative overhead in large networks and does not provide per-session authentication, encryption binding, or key derivation.

Go deeper

Related to this question