easyMultiple Choice
SSCP Practice Question: Wants to ensure that only authorized devices can…
An organization wants to ensure that only authorized devices can connect to its internal network. Which of the following should be implemented?
⚠ Common exam trap
Candidates often confuse Port Security (a Layer 2 MAC-based control) with NAC, but Port Security lacks the authentication, posture assessment, and dynamic policy enforcement that NAC provides, making it insufficient for ensuring only authorized devices connect.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network access control (NAC)
Network Access Control (NAC) is the correct choice because it enforces security policy by evaluating the identity, posture, and compliance of devices before granting network access. NAC solutions (e.g., Cisco ISE, Aruba ClearPass) can authenticate devices via 802.1X, check for antivirus updates or patch levels, and quarantine non-compliant endpoints, ensuring only authorized and healthy devices connect to the internal network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Intrusion detection system
Why it's wrong here
IDS detects threats, does not control access.
- ✗
Port security on switches
Why it's wrong here
Port security restricts which MAC addresses may use a switch port, but it operates at Layer 2 per-port and cannot validate device identity or health across the network. It tempts because it blocks unknown devices at the access edge, which suits preventing rogue hardware in a wired closet.
- ✓
Network access control (NAC)
Why this is correct
Network access control enforces endpoint compliance and identity checks before granting a device access to the internal network, blocking unauthorised devices at the connection point. This directly satisfies the requirement that only authorised devices connect.
- ✗
Virtual private network
Why it's wrong here
A VPN encrypts traffic between remote users and the network but authenticates users, not device identity, so an unauthorised endpoint with valid credentials still connects. It tempts because it secures remote access, which is the right answer when the requirement is confidentiality over untrusted links.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.