802.1X Port Authentication
A security auditor recommends implementing a solution that authenticates users and devices before granting network access, regardless of the physical port they connect to. Which technology should be deployed?
Quick Answer
802.1X is the right technology because the requirement specifically calls for authentication tied to the act of connecting - before any traffic is allowed onto the network - rather than something layered on afterward. This is what port-based network access control (PNAC) means: the switch or access point holds a port closed by default and only opens it once a supplicant has proven its identity through an EAP exchange carried over EAPoL to a RADIUS server. Because that authentication step is bound to every physical or logical port equally, it doesn't matter which port a device plugs into - the same access control applies uniformly across the network, which is exactly the auditor's requirement. This distinguishes 802.1X from technologies that only filter traffic after a device is already connected, since those approaches assume the device already has network access and merely restrict what it can do with it. When you see exam language emphasizing that access must be authenticated at the point of connection and enforced consistently regardless of physical location, that phrasing is pointing you toward port-based access control - and on the Network+ exam, 802.1X is the technology built specifically for that job.
⚠ Common exam trap
It's easy for candidates to confuse port security with 802.1X because both control port access, but port security only filters by MAC address and does not provide user authentication or integration with a central authentication server, which is the key requirement in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
802.1X
802.1X is the correct technology because it provides port-based network access control (PNAC) that authenticates users and devices before granting network access, regardless of the physical port they connect to. It uses the Extensible Authentication Protocol (EAP) over LAN (EAPoL) to communicate with a RADIUS server, ensuring that only authenticated endpoints are allowed on the network. This meets the auditor's requirement for authentication at the port level, independent of the switch port used.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Port security
Why it's wrong here
Port security limits the number of MAC addresses allowed on a port but does not authenticate users or devices.
When this WOULD be correct
A question asks: 'Which feature prevents unauthorized devices from connecting to a switch by limiting the number of MAC addresses per port?' Then port security would be correct.
- ✓
802.1X
Why this is correct
802.1X provides port-based authentication using EAP and requires credentials from the device or user.
- ✗
VLAN hopping
Why it's wrong here
VLAN hopping is an attack technique, not a security control.
When this WOULD be correct
A question asking 'Which attack allows a device to access traffic from a different VLAN by manipulating trunking protocols?' would have VLAN hopping as the correct answer.
- ✗
DHCP snooping
Why it's wrong here
DHCP snooping filters DHCP messages and prevents rogue DHCP servers, but does not authenticate devices.
When this WOULD be correct
A question asks: 'Which technology prevents unauthorized DHCP servers from assigning IP addresses on a network?' In that context, DHCP snooping is the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓802.1XCorrect answer▾
Why this is correct
802.1X provides port-based authentication using EAP and requires credentials from the device or user.
✗Port securityWrong answer — click to see why▾
Why this is wrong here
Port security limits MAC addresses per port but does not authenticate users or devices before granting network access; it only controls which MAC addresses are allowed on a specific switch port.
★ When this WOULD be the correct answer
A question asks: 'Which feature prevents unauthorized devices from connecting to a switch by limiting the number of MAC addresses per port?' Then port security would be correct.
Why candidates choose this
Candidates confuse port security with network access control because both deal with restricting device connections, but port security lacks authentication and is port-specific.
✗VLAN hoppingWrong answer — click to see why▾
Why this is wrong here
VLAN hopping is an attack technique, not a security solution. It exploits switch configuration to gain unauthorized access to VLANs, whereas the question asks for a technology that authenticates users and devices before granting network access.
★ When this WOULD be the correct answer
A question asking 'Which attack allows a device to access traffic from a different VLAN by manipulating trunking protocols?' would have VLAN hopping as the correct answer.
Why candidates choose this
Candidates may confuse VLAN hopping with a security mechanism because it involves network access control at the VLAN level, but it is actually a vulnerability, not a solution.
✗DHCP snoopingWrong answer — click to see why▾
Why this is wrong here
DHCP snooping is a security feature that filters untrusted DHCP messages to prevent rogue DHCP servers, but it does not authenticate users or devices before granting network access.
★ When this WOULD be the correct answer
A question asks: 'Which technology prevents unauthorized DHCP servers from assigning IP addresses on a network?' In that context, DHCP snooping is the correct answer.
Why candidates choose this
Candidates may confuse DHCP snooping with network access control because both involve security at the switch level, leading them to think it can authenticate users.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
EAPoL
EAPoL is a network authentication protocol that encapsulates EAP frames over IEEE 802 LANs, enabling port-based access control.
Key term
RADIUS
RADIUS is a network protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on N10-009
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which of the following security mechanisms requires a user to authenticate before gaining access to the wired network at a switch port?
easy- ✓ A.802.1X
- B.Port security
- C.ACL
- D.MAC authentication
Why A: 802.1X is a port-based Network Access Control (NAC) standard (IEEE 802.1X) that requires a user or device to authenticate via an authentication server (e.g., RADIUS) before the switch port transitions from an unauthorized to an authorized state, allowing full network access. It uses Extensible Authentication Protocol (EAP) over LAN (EAPoL) to carry authentication messages between the supplicant (client), authenticator (switch), and authentication server. This ensures that only authenticated users can access the wired network at the switch port level.
Variation 2. A company wants to ensure that only authorized employee computers can connect to the wired network. Each computer must be authenticated before it is granted access to the network. Which technology is designed to provide this port-based authentication?
easy- ✓ A.802.1X
- B.WPA2
- C.MAC filtering
- D.VPN
Why A: 802.1X is the IEEE standard for port-based Network Access Control (NAC). It uses the Extensible Authentication Protocol (EAP) over LAN (EAPoL) to authenticate a device at the switch port before granting full network access. Only after successful authentication does the switch open the port, ensuring that unauthorized computers cannot connect.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.