easyMultiple ChoiceObjective-mapped
CISSP Practice Question: Wants to ensure that only devices that meet…
An organization wants to ensure that only devices that meet security policies can connect to the network. Which technology should be deployed?
⚠ Common exam trap
Candidates often confuse NAC with a firewall or IDS, as candidates often think a firewall's access control lists (ACLs) are sufficient for device compliance, but NAC specifically performs pre-admission posture checking that firewalls cannot do.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NAC
Network Access Control (NAC) is the correct technology because it enforces security policies by assessing the compliance of devices (e.g., patch level, antivirus status, OS version) before granting network access. NAC can quarantine non-compliant devices, redirect them to a remediation network, or block them entirely, ensuring only authorized and policy-compliant endpoints connect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Firewall
Why it's wrong here
Firewalls primarily filter network traffic based on rules like IP addresses, ports, and protocols, operating at lower network layers to control ingress/egress flow and segment networks. While essential for perimeter defense and traffic management, a firewall cannot inspect the internal security posture of a connecting device, such as its patch level, antivirus status, or configuration, to determine if it meets compliance requirements before granting access.
- ✗
SIEM
Why it's wrong here
A Security Information and Event Management (SIEM) system collects, aggregates, and analyzes security logs and events from various network devices, applications, and systems across an organization. Its core function is to provide real-time monitoring, detect security incidents through correlation, and support forensic investigations. While crucial for identifying threats and compliance deviations post-event, a SIEM is a detective control and does not actively enforce pre-connection device compliance or prevent non-compliant devices from initially accessing the network.
- ✗
IDS
Why it's wrong here
An Intrusion Detection System (IDS) monitors network traffic or system activities for suspicious patterns, known attack signatures, or policy violations, generating alerts when potential threats are detected. It serves as a critical detective control, identifying malicious activity or policy breaches after they occur or are in progress. However, an IDS does not possess the capability to proactively assess a device's compliance posture before it connects to the network, nor can it directly enforce access control based on that assessment.
- ✓
NAC
Why this is correct
Network Access Control (NAC) is a security solution specifically designed to enforce policies on devices attempting to gain access to a network. It performs a comprehensive assessment of an endpoint's security posture, verifying attributes such as operating system patches, antivirus definitions, and configuration settings against predefined compliance standards. Based on this assessment, NAC dynamically grants, denies, or quarantines devices, ensuring only compliant endpoints can access network resources, thereby preventing non-compliant devices from introducing risk.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.