SY0-701 Security Operations Practice Question
A help desk technician receives an alert that an unmanaged laptop was plugged into a conference room network jack and was automatically placed into a restricted network segment until it passed a security check. Which control is responsible for that behavior?
⚠ Common exam trap
Many candidates confuse NAC with an IPS or firewall because both can block traffic, but NAC specifically controls access at the point of network entry (Layer 2) based on device identity and compliance, not by inspecting packet payloads.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network access control (NAC).
Network Access Control (NAC) is the correct answer because it is specifically designed to enforce security policies on devices attempting to connect to a network. When an unmanaged laptop is plugged into a network jack, NAC evaluates the device's compliance (e.g., antivirus status, patch level) and, if it fails, automatically places it into a restricted segment (e.g., a quarantine VLAN) until it passes a security check. This behavior is a core function of NAC solutions like Cisco ISE or Aruba ClearPass, which use 802.1X or MAC authentication bypass to dynamically assign VLANs based on device posture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Network access control (NAC).
Why this is correct
NAC (Network Access Control) is the security technology that evaluates a device's security posture before granting network access. It typically uses protocols like 802.1X for authentication and checks compliance criteria—such as patch level, antivirus status, or encryption—via an agent or client. If a device is found noncompliant, NAC can isolate it into a quarantine VLAN or redirect it to remediation servers, thereby directly controlling admission. This aligns exactly with the incident described, where an unmanaged device must be assessed and segregated.
- ✗
Data loss prevention (DLP).
Why it's wrong here
Data Loss Prevention (DLP) is designed to prevent sensitive information from leaving the network without authorization, using content inspection and context-aware policies. It operates on data-in-motion, data-at-rest, and data-in-use, but it does not evaluate whether a particular endpoint is managed or compliant. DLP would not block an unmanaged device from connecting; it only examines the traffic it sends or receives. Consequently, DLP's focus on data confidentiality does not address the network access control requirement here.
- ✗
Intrusion prevention system (IPS).
Why it's wrong here
An Intrusion Prevention System (IPS) sits inline and actively blocks malicious packets based on signature matching, anomaly detection, or reputation feeds. While an IPS can stop an attack from a problematic device, it operates at the application or network layer after the connection is already established, not at the point of admission. It lacks the ability to perform device-level authentication, posture checking, or VLAN assignment. Therefore, an IPS is a reactive threat control, not a proactive access control mechanism.
- ✗
Sandboxing gateway.
Why it's wrong here
A sandboxing gateway is used to detonate suspicious files, URLs, or email attachments in an isolated virtual environment to observe their behavior and identify malware. It provides deep analysis and threat intelligence, but it does not sit at the network edge to decide whether an endpoint can join the network. The gateway typically receives traffic forwarded from other security devices and returns an analysis verdict, not an access decision. Thus, sandboxing is irrelevant to managing the connection of an unmanaged device.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
NAC
Network Access Control (NAC) is a security technology that enforces policies to control which devices and users can connect to a network.
Key term
VLAN
A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they are on the same physical network segment, regardless of their actual physical location.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.