SSCP Network and Communications Security Practice Question
An organization wants to ensure that only corporate-managed devices can connect to the internal network. Non-compliant devices should be placed in a restricted VLAN with limited access. Which technology should be deployed?
⚠ Common exam trap
Candidates often confuse 'restrict access' with firewall/IPS filtering — candidates pick a stateful firewall or IPS because they think of blocking traffic, but the question is about device identity and posture-based admission, which only NAC provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network Access Control (NAC)
NAC (Network Access Control) is purpose-built to enforce endpoint compliance before granting network access. It authenticates devices via 802.1X, MAC authentication bypass, or agent-based posture checks, and can dynamically assign non-compliant devices to a quarantine/restricted VLAN with limited ACLs. This matches the requirement of allowing only corporate-managed devices on the internal network while isolating others.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Virtual Private Network (VPN)
Why it's wrong here
A VPN encrypts and tunnels remote connections into the network; it does not verify endpoint compliance or place non-compliant devices into a quarantine VLAN. It is tempting because VPNs gate remote access, and would be correct for securing connectivity from off-site users rather than enforcing posture on the LAN.
- ✓
Network Access Control (NAC)
Why this is correct
NAC enforces admission control at the network edge, authenticating and assessing device posture before granting access. Non-compliant devices are dynamically assigned to a restricted VLAN, exactly matching the requirement that only corporate-managed devices reach the internal network.
- ✗
Stateful firewall
Why it's wrong here
A stateful firewall filters traffic by connection state, port and protocol; it cannot assess device identity or compliance, so it cannot segregate non-compliant endpoints into a restricted VLAN. It is tempting because firewalls enforce network segmentation, and would suit controlling traffic between existing VLANs.
- ✗
Intrusion Prevention System (IPS)
Why it's wrong here
IPS monitors for attacks, not device compliance.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.