hardMultiple ChoiceObjective-mapped
802.1X Authentication Server RADIUS
An organization is implementing 802.1X authentication for wired network access. Which server is required to authenticate users?
Quick Answer
A RADIUS server is required in an 802.1X deployment because 802.1X itself is only a port-based access control framework. It defines how a device, the supplicant, and a switch or access point, the authenticator, exchange authentication messages using the Extensible Authentication Protocol, but it doesn't perform the actual credential validation itself. That job is handed off to a backend authentication server, and in the 802.1X architecture as defined in IEEE 802.1X-2020, that backend role is filled by RADIUS: the authenticator relays the EAP conversation to the RADIUS server using the RADIUS protocol defined in RFC 2865, and the RADIUS server checks the credentials against its user directory and returns an accept or reject decision. Only after RADIUS approves the request does the switch open the port and grant the device network access. This three-party structure, supplicant, authenticator, and authentication server, is the defining architecture of 802.1X, and RADIUS is the standard, near-universal choice for the authentication server role because it's purpose-built to centralize authentication, authorization, and accounting decisions for network access. Whenever a question asks what server or service 802.1X relies on to validate credentials, RADIUS is the answer to look for, since the switch or access point itself never independently makes that authentication decision.
⚠ Common exam trap
Watch out — candidates often confuse TACACS+ with RADIUS because both are AAA protocols, but 802.1X specifically mandates RADIUS for EAP transport, whereas TACACS+ encrypts the entire packet and is used for device administration, not port-based network access control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RADIUS server
802.1X is a port-based network access control protocol that uses the Extensible Authentication Protocol (EAP) to authenticate devices before granting network access. The authentication server in an 802.1X deployment must be a RADIUS server, as defined in IEEE 802.1X-2020, because it acts as the backend that validates credentials and communicates with the authenticator (switch) via RADIUS (RFC 2865).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DHCP server
Why it's wrong here
DHCP assigns IP addresses but does not authenticate users for network access.
- ✗
TACACS+ server
Why it's wrong here
TACACS+ is primarily used for administrative access to network devices, not for 802.1X authentication.
- ✗
Kerberos server
Why it's wrong here
Kerberos is used for authentication in Windows domains but is not directly used in 802.1X (though it can be integrated with RADIUS).
- ✓
RADIUS server
Why this is correct
RADIUS is the standard authentication server for 802.1X, handling user credentials and policy enforcement.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to enforce network access control (NAC) for both wired and wireless devices. Which protocol is used for this purpose?
medium- ✓ A.802.1X
- B.SNMP (Simple Network Management Protocol)
- C.EAP (Extensible Authentication Protocol)
- D.PAP (Password Authentication Protocol)
Why A: 802.1X is the IEEE standard for port-based network access control (NAC) that authenticates devices before granting access to both wired and wireless networks. It operates at the data link layer and uses an authentication server (e.g., RADIUS) to validate credentials, ensuring only authorized devices connect to the network.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.