SSCP Network and Communications Security Practice Question
Which network security control can enforce that only authorized devices with current antivirus and patches can connect to the network?
⚠ Common exam trap
Many candidates confuse network access control with other security controls that also restrict access, such as firewalls or port security, but do not perform endpoint posture checking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network Access Control
Network Access Control (NAC) is designed to enforce endpoint compliance before granting network access. It checks devices for up-to-date antivirus, patches, and other security posture requirements, and can quarantine or deny access if they fail. This matches the requirement of ensuring only authorized devices with current antivirus and patches can connect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Firewall rules
Why it's wrong here
Firewall rules filter traffic by address, port and protocol, controlling reachability rather than endpoint health. It tempts because firewalls are the default network access control; however, they cannot query a device's antivirus signatures or patch status, so an authorised host with outdated protection still passes.
- ✓
Network Access Control
Why this is correct
Network Access Control enforces endpoint compliance at connection time, quarantining or denying devices whose antivirus definitions or patches are missing or outdated. It is the only listed control that gates network admission on the device's current security posture.
- ✗
Intrusion Prevention System
Why it's wrong here
An Intrusion Prevention System inspects traffic for malicious patterns and blocks detected attacks in real time. It tempts because it enforces security policy on the wire; however, it evaluates packets, not endpoint posture, so it cannot verify that a connecting device has current antivirus and patches.
- ✗
Port security
Why it's wrong here
Port security restricts which MAC addresses may use a switch port, defending against rogue devices at layer two. It tempts because it does gate device admission; however, it cannot inspect antivirus state or patch levels, so a compliant-looking authorised device with outdated protection still connects.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization wants to ensure that only authorized devices can connect to the corporate wired network. Which technology should they implement to enforce this?
medium- ✓ A.Network Access Control (NAC) with 802.1X
- B.VLAN segmentation
- C.MAC address filtering
- D.Firewall rules
Why A: Network Access Control (NAC) with 802.1X authenticates devices before granting network access, enforcing compliance and authorization.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.