easyMultiple Choice
SSCP Practice Question: Wants to prevent unauthorized devices from…
An organization wants to prevent unauthorized devices from connecting to its wired network. Which security control should be implemented?
⚠ Common exam trap
ISC2 often tests the misconception that MAC-based controls (port security or MAC filtering) provide strong authentication, when in fact they are easily bypassed by MAC spoofing, whereas 802.1X uses cryptographic credentials or certificates for true device authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IEEE 802.1X port-based authentication
IEEE 802.1X port-based authentication is the correct control because it authenticates each device at the network edge before granting access to the wired LAN. It uses an authentication server (e.g., RADIUS) to verify credentials or certificates, effectively preventing unauthorized devices from connecting. Unlike MAC-based controls, 802.1X provides dynamic, per-session authentication that cannot be easily spoofed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Port security with sticky MAC
Why it's wrong here
Sticky MAC binds a learned address to a port, but an attacker can spoof the sticky address or simply wait until the legitimate device is disconnected. It fits limiting which known devices use a port, not authenticating unknown ones; 802.1X is required here.
- ✗
MAC address filtering
Why it's wrong here
MAC address filtering inspects only the Layer 2 hardware address, which any attacker can spoof in software, so it cannot authenticate a device's identity or health before granting a wired port. It is tempting because it genuinely restricts known endpoints on small, static networks, but 802.1X with Microsoft Entra ID satisfies the scenario's unauthorized-device requirement.
- ✗
VLAN segmentation
Why it's wrong here
VLAN segmentation separates broadcast domains and traffic paths but does not authenticate endpoints; an unauthorised device plugged into an access port still joins its VLAN. It is the right control for limiting lateral movement between trusted segments, not for admission.
- ✓
IEEE 802.1X port-based authentication
Why this is correct
IEEE 802.1X enforces port-based authentication at the switch, requiring devices to authenticate via a supplicant, authenticator and RADIUS server before any traffic passes. This directly satisfies the stem's constraint of blocking unauthorised devices from the wired network, since unauthenticated ports remain closed.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.