Courseiva

CCNA Layer 2 Authentication And Access Control Questions

36 questions · Layer 2 Authentication And Access Control · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selecthard

Which THREE statements describe the behavior of critical authentication (fallback) when a RADIUS server becomes unreachable on an EX Series switch? (Choose three)

Select 3 answers
A.The switch moves authenticating clients into a designated critical VLAN or applies a critical profile.
B.The local switch user database is permanently deleted to save memory during server failure.
C.Critical authentication can be configured separately for 802.1X and MAC RADIUS authentication methods.
D.Clients that are already successfully authenticated are immediately disconnected and forced to re-authenticate.
E.The switch continues to probe the primary RADIUS servers at configured intervals to detect recovery.
AnswersA, C, E

Correct. Critical fallback assigns clients to predefined critical parameters.

Why this answer

Critical authentication allows clients to be placed into a critical VLAN or access profile when RADIUS servers are unresponsive, preventing complete network lockout.

Practice this question →
2
MCQeasy

Which statement is true regarding the behavior of the supplicant mode 'single' on an EX Series switch port?

A.Only one supplicant is allowed on the port; if a second device connects, it is blocked or unauthenticated.
B.It allows up to 256 MAC addresses to authenticate simultaneously via MAC RADIUS.
C.Multiple supplicants are allowed, but they must all share the same VLAN and credentials.
D.It enables multi-domain authentication for voice and data devices.
AnswerA

Correct. Single mode restricts the port to one authenticated client.

Why this answer

Single-supplicant mode allows only a single authenticated client on the port. If a hub or IP phone with a PC is connected, only one device passes authentication.

Practice this question →
3
MCQhard

An EX Series switch is configured with multiple-supplicant mode on an access port connected to an IP phone with a PC daisy-chained behind it. The IP phone authenticates via 802.1X, but the PC uses MAC RADIUS. The phone authenticates successfully and moves to the voice VLAN. However, when the PC boots, it fails authentication because the switch rejects a second supplicant on the same logical port index. Which configuration parameter resolves this issue?

A.Configure 'set access-profile captive-portal multiple-logins per-port'.
B.Set the port mode to trunk and enable voice-vlan stacking.
C.Configure the interface with 'set protocols dot1x interface ge-0/0/1 mac-radius multiple-clients'.
D.Configure the interface with 'set protocols dot1x interface ge-0/0/1 supplicant multiple' and ensure multi-supplicant mode is active.
AnswerD

Correct. Enabling multiple supplicants per port allows both the IP phone and the PC to authenticate independently.

Why this answer

In multiple-supplicant mode, you must configure 'supplicant multiple' and ensure the port is configured to support multiple clients using different authentication methods (e.g., multi-supplicant mode rather than single-supplicant).

Practice this question →
4
MCQeasy

Which command allows an administrator to verify the active supplicant states and authentication status on a specific EX Series switch interface?

A.show ethernet-switching table dot1x
B.show access security clients
C.show radius-server authentication statistics
D.show dot1x interface
AnswerD

Correct. This command shows the operational state of 802.1X on interfaces.

Why this answer

The 'show dot1x interface' command displays detailed information about 802.1X states on switch ports.

Practice this question →
5
MCQeasy

What is the default authentication order when authentication is enabled on an EX Series switch interface without explicit ordering configuration?

A.captive-portal
B.dot1x
C.local database
D.mac-radius
AnswerB

Correct. Dot1x is the default primary method when order is omitted.

Why this answer

By default, if authentication order is not specified, dot1x is evaluated first.

Practice this question →
6
Multi-Selectmedium

Which TWO actions occur when an 802.1X supplicant fails authentication and a guest VLAN is configured on the EX Series switch port? (Choose two)

Select 2 answers
A.The switch assigns the interface to the specified guest VLAN.
B.The client retains access to network resources restricted by the guest VLAN boundaries.
C.The switch sends a RADIUS accounting stop packet for the failed session.
D.The switch permanently disables the physical port until a manual reset is issued.
E.The supplicant is automatically migrated to the critical authentication server group.
AnswersA, B

Correct. Failure moves the port into the guest VLAN.

Why this answer

When authentication fails and a guest VLAN is defined, the port is moved to the guest VLAN, and standard re-authentication timers or failure actions apply.

Practice this question →
7
MCQhard

An EX4300 switch is configured with captive portal authentication. Unauthenticated users are successfully redirected when attempting HTTP traffic, but HTTPS traffic fails to redirect properly and instead shows a certificate warning or connection timeout in the user's browser. What is the fundamental reason for this behavior with standard captive portal implementations?

A.Standard captive portal redirects rely on intercepting unencrypted HTTP traffic; intercepting HTTPS without SSL proxy causes certificate mismatch errors.
B.HTTPS traffic is blocked by default firewall filters and is excluded from the captive portal bypass list.
C.The captive portal server only listens on TCP port 80 and drops all incoming TCP port 443 SYN packets.
D.The captive portal profile lacks a valid SSL certificate for HTTPS traffic decryption.
AnswerA

Correct. HTTPS encryption prevents seamless Layer 2 HTTP redirection.

Why this answer

Standard Layer 2 captive portal implementations intercept HTTP traffic via destination NAT or HTTP redirection. HTTPS traffic cannot be intercepted without a Man-in-the-Middle (MITM) proxy and SSL decryption because the TLS handshake fails due to certificate mismatch.

Practice this question →
8
Multi-Selectmedium

Which TWO statements are correct regarding the behavior and configuration of multi-supplicant mode on EX Series switches? (Choose two)

Select 2 answers
A.It restricts the port to operating exclusively as an access trunk port.
B.It requires all connected devices to use identical EAP methods and credentials.
C.Each authenticated client on the port can be placed into its own dynamic VLAN via RADIUS.
D.It is mutually exclusive with MAC RADIUS fallback configurations.
E.It allows multiple supplicants to authenticate independently on the same physical port.
AnswersC, E

Correct. Dynamic VLAN assignment works per supplicant in multi-supplicant mode.

Why this answer

Multi-supplicant mode allows multiple clients on a single port to authenticate independently. Each client maintains its own authentication state machine.

Practice this question →
9
MCQhard

An EX Series switch is configured with 802.1X and MAC RADIUS. A client device connects that does not support 802.1X. The switch attempts 802.1X, times out, and successfully falls back to MAC RADIUS. However, the administrator notices a significant delay (several seconds) before the MAC RADIUS request is sent to the server. What parameter should be tuned to reduce this delay?

A.Reduce the 'supp-timeout' and 'max-retries' parameters under the 802.1X interface configuration.
B.Increase the 'server-timeout' parameter in the access-profile configuration.
C.Disable EAPOL-start message generation on the switch port.
D.Enable fast-reauth under the system authentication options.
AnswerA

Correct. Tuning down dot1x retry counts and timeouts accelerates the transition to fallback methods.

Why this answer

The delay is caused by the 802.1X supplicant timeout and retries before giving up and falling back to MAC RADIUS. Reducing 'supp-timeout' and 'max-retries' minimizes this delay.

Practice this question →
10
MCQhard

An administrator configures 802.1X authentication with local server fallback on an EX Series switch. When the external RADIUS server is unreachable, the switch fails over to the local user database. However, users authenticated via the local database are placed in the default access VLAN instead of the VLAN specified in their local user profile. What is the cause of this behavior?

A.The local fallback profile was not bound to the interface using the 'fallback-profile' command.
B.Local database user profiles on Junos do not support dynamic VLAN assignment attributes natively, requiring interface-level default fallback VLANs.
C.The local database uses PAP, which strips VLAN assignment attributes from the authentication reply.
D.RADIUS accounting was disabled, preventing local attribute synchronization.
AnswerB

Correct. Junos local authentication has limited attribute return capabilities compared to external RADIUS.

Why this answer

When using local fallback authentication on Junos switches, local user database entries lack the rich attribute support (like dynamic VLAN assignment via RADIUS VSA equivalents) unless explicitly mapped or configured via local database profiles.

Practice this question →
11
MCQmedium

You are troubleshooting an 802.1X deployment on an EX4300 switch. Clients fail to authenticate when using Supplicant-based authentication combined with MAC RADIUS fallback. You notice that the switch does not attempt MAC RADIUS after 802.1X times out. Which configuration error most likely caused this?

A.You enabled static MAC pinning on the access port, which disables fallback mechanisms.
B.You omitted the mac-radius statement from the global protocols access-profile configuration.
C.You configured the supplicant mode as single-supplicant instead of multi-supplicant.
D.You failed to include both dot1x and mac-radius within the interface authentication-order statement.
AnswerD

Correct. The switch evaluates authentication methods based on the defined authentication-order.

Why this answer

To fall back to MAC RADIUS when 802.1X fails, the 'authentication-order' statement must explicitly list both dot1x and mac-radius, and the fallback mechanism must be configured properly.

Practice this question →
12
MCQmedium

You are configuring an EX Series switch to support MAC RADIUS authentication. You want to ensure that the switch sends accounting start and stop packets to the RADIUS server. Which configuration hierarchy is required to enable RADIUS accounting for access clients?

A.[edit protocols dot1x accounting-options]
B.[edit system radius-server accounting]
C.[edit protocols access-profile profile-name accounting]
D.[edit access-control accounting-profile]
AnswerC

Correct. Accounting is configured under the access-profile hierarchy.

Why this answer

RADIUS accounting for access control clients in Junos is configured under the access profile hierarchy using the 'accounting' statement.

Practice this question →
13
MCQhard

An administrator implements MAC RADIUS authentication on an EX Series switch. Several legacy printers connected to the ports fail to authenticate because they send their MAC addresses in uppercase letters with no separators (AABBCCDDEEFF), while the RADIUS server expects lowercase with colons (aa:bb:cc:dd:ee:ff). How can you resolve this mismatch on the Junos switch?

A.Enable MAC-address translation (MAT) on the Ethernet switching table.
B.Configure the local user database to normalize MAC addresses automatically.
C.Configure the MAC address format under the access-profile mac-radius options using the lowercase and colon-delimiter settings.
D.Configure a regex-based rewriting firewall filter on the interface facing the printers.
AnswerC

Correct. Access profiles support formatting options for MAC RADIUS requests.

Why this answer

Junos OS allows configuring the MAC address format in MAC RADIUS requests via the 'mac-radius' settings under access profiles, allowing conversion to lowercase or specific separator formats.

Practice this question →
14
MCQmedium

You are configuring captive portal on an EX Series switch. You want users to be redirected to an external web server hosted at https://portal.enterprise.com/login. Where do you specify this redirection URL in the Junos OS CLI?

A.Under [edit access captive-portal profile profile-name redirection url].
B.Under [edit protocols dot1x captive-portal url].
C.Under [edit system services web-management captive-portal interface ge-0/0/1 redirect-url].
D.Under [edit forwarding-options captive-portal gateway].
AnswerA

Correct. The access captive-portal profile defines redirection parameters.

Why this answer

Captive portal redirect URLs are configured within the captive-portal profile hierarchy.

Practice this question →
15
Multi-Selectmedium

Which TWO conditions must be satisfied for an EX Series switch to successfully process a RADIUS Change of Authorization (CoA) request? (Choose two)

Select 2 answers
A.The client must be actively running a captive portal browser session.
B.The RADIUS server must be configured as a dynamic client or CoA must be enabled on the switch access profile.
C.RADIUS accounting must be disabled globally across the entire switch.
D.The switch port must be configured in access trunk mode with static VLAN pinning.
E.The pre-shared secret configured on the RADIUS server for CoA must match the shared secret configured on the switch.
AnswersB, E

Correct. CoA requires explicit configuration to accept dynamic requests.

Why this answer

RADIUS CoA requires the switch to have dynamic-clients or CoA enabled in the access profile/RADIUS server configuration, and the switch must share the correct pre-shared secret with the RADIUS server.

Practice this question →
16
MCQmedium

You are implementing MAC RADIUS authentication on an EX4600 switch. You notice that when a device connects, the switch sends the MAC address in the Username attribute (RADIUS attribute 1) with hyphen separators (e.g., aa-bb-cc-dd-ee-ff). Your RADIUS server expects colons (aa:bb:cc:dd:ee:ff). Where must you configure this format change on Junos OS?

A.Under [edit protocols access-profile profile-name mac-radius] using the format option.
B.Under [edit system radius-server server-name] using the attribute-format option.
C.Under [edit interfaces ge-0/0/1 unit 0 family ethernet-switching] using the mac-radius format command.
D.Under [edit access profile profile-name firewall] using the translation map.
AnswerA

Correct. Access profile configurations define the MAC address format for RADIUS requests.

Why this answer

Junos OS allows modifying the MAC address format sent to the RADIUS server using the 'mac-radius' configuration hierarchy under access profile or interface settings, specifically via the 'mac-питан' or format options.

Practice this question →
17
MCQeasy

What is the primary function of the RADIUS server attribute 'Tunnel-Medium-Type' (Attribute 65) when received during an 802.1X authentication exchange on an EX Series switch?

A.It defines the VLAN ID or VLAN name to which the authenticated client port should be dynamically assigned.
B.It determines the encryption cipher used between the switch and the RADIUS server.
C.It specifies the physical transport media type for the tunnel, such as 802 (Ethernet) for VLAN assignment.
D.It indicates the authentication protocol (PAP, CHAP, EAP) being used in the tunnel.
AnswerC

Correct. Attribute 65 defines the medium type (typically 802 for IEEE 802 networks).

Why this answer

Tunnel-Medium-Type specifies the media type of the tunnel, which for VLAN assignments in Junos is typically set to 802 (Ethernet).

Practice this question →
18
MCQeasy

An enterprise network administrator needs to configure 802.1X authentication on EX Series switches. Which statement is correct regarding the default behavior of the supplicant timeout timer?

A.It dictates how long the switch waits before failing over to MAC RADIUS authentication.
B.It determines how long an authenticated client can remain idle before being disconnected.
C.It defines the duration the switch waits for an EAP-Request/Identity frame response before retransmitting.
D.It specifies the interval before the switch drops the entire RADIUS authentication session.
AnswerC

Correct. supp-timeout dictates the wait time for the initial identity response.

Why this answer

The supp-timeout timer specifies the time the switch waits for a response to an EAP-Request/Identity frame from the supplicant before retransmitting.

Practice this question →
19
Multi-Selectmedium

Which TWO statements are correct regarding captive portal redirection behavior on EX Series switches? (Choose two)

Select 2 answers
A.Clients can be granted pre-authentication access to specific IP addresses using a walled garden or bypass list.
B.Captive portal redirection requires the client to run a proprietary Juniper client software agent.
C.HTTPS traffic is automatically decrypted and redirected without client browser certificate errors.
D.Unauthenticated HTTP traffic is intercepted and redirected to the captive portal login URL.
E.Redirection is achieved by modifying the client's local operating system registry settings via DHCP.
AnswersA, D

Correct. Bypass lists permit pre-auth traffic.

Why this answer

Captive portal intercepts HTTP traffic to redirect unauthenticated clients and supports walled garden bypass for specific destinations.

Practice this question →
20
MCQeasy

Which statement accurately describes the function of the 'server-timeout' setting within a Juniper access profile?

A.It determines the maximum duration a client session can remain active before forced re-authentication.
B.It defines how long the switch waits for a reply from the RADIUS server before failing over to the next server.
C.It dictates the interval at which the switch sends RADIUS accounting interim updates.
D.It specifies the idle timeout period for disconnected supplicants.
AnswerB

Correct. server-timeout controls the retry timer for RADIUS requests.

Why this answer

The server-timeout setting determines how long the switch waits for a response from a RADIUS server before trying the next server in the server group.

Practice this question →
21
Multi-Selectmedium

Which TWO options are valid configurable parameters under an access profile in Junos OS? (Choose two)

Select 2 answers
A.radius-server-group
B.virtual-router-instance
C.ethernet-switching-options
D.storm-control
E.accounting
AnswersA, E

Correct. Radius server groups are defined under access profiles.

Why this answer

Access profiles contain RADIUS server groups, accounting parameters, and authentication order settings.

Practice this question →
22
MCQeasy

Which command is used to clear dynamic MAC RADIUS authentication states and force a re-authentication on interface ge-0/0/5?

A.clear ethernet-switching security-table interface ge-0/0/5
B.clear access client-profile ge-0/0/5
C.clear dot1x interface ge-0/0/5
D.clear mac-radius statistics interface ge-0/0/5
AnswerC

Correct. Clearing the dot1x interface resets the state machine for both 802.1X and associated MAC RADIUS fallback.

Why this answer

To clear dot1x or mac-radius states on an interface, the 'clear dot1x statistics' or 'clear access security' commands are used, or more specifically 'clear dot1x interface' to reset the state machine.

Practice this question →
23
MCQeasy

Which RADIUS attribute is commonly used to assign a specific session timeout value to an 802.1X authenticated client on an EX Series switch?

A.Idle-Timeout (Attribute 28)
B.Tunnel-Client-End-Id (Attribute 66)
C.Termination-Action (Attribute 29)
D.Session-Timeout (Attribute 27)
AnswerD

Correct. Attribute 27 governs session timeout.

Why this answer

RADIUS Attribute 27 (Session-Timeout) specifies the maximum number of seconds of service to be provided to the user.

Practice this question →
24
Multi-Selecthard

Which THREE diagnostic tools or show commands are useful when troubleshooting MAC RADIUS authentication failures on an EX Series switch? (Choose three)

Select 3 answers
A.Traceoptions configured under protocols dot1x and access-profile for logging.
B.show access security clients
C.show dot1x interface detail
D.traceroute mac-address
E.show access radius-server statistics
AnswersA, C, E

Correct. Traceoptions provide detailed debug logs for authentication flows.

Why this answer

Troubleshooting MAC RADIUS involves checking traceoptions, access client states, and dot1x interface details.

Practice this question →
25
MCQmedium

You are configuring MAC RADIUS authentication on an EX Series switch and want to ensure that devices failing MAC RADIUS are assigned to a restricted quarantine VLAN. Where is the quarantine VLAN configured for failed MAC RADIUS attempts?

A.Under [edit protocols dot1x interface ge-0/0/1 failure-action vlan quarantine-vlan].
B.Under [edit access profile profile-name radius-options quarantine-vlan].
C.Under [edit forwarding-options storm-control profile quarantine].
D.Under [edit vlans quarantine-vlan captive-portal-binding].
AnswerA

Correct. Failure actions for dot1x/mac-radius dictate VLAN placement on failure.

Why this answer

Failed authentication action (such as assigning a guest or restricted VLAN) in Junos switch access control is configured under the interface or protocol fallback/fail action hierarchy, such as 'retries' or 'no-response-action' / 'failure-action'.

Practice this question →
26
Multi-Selecthard

Which THREE attributes or conditions must be met for successful dynamic VLAN assignment via RADIUS during 802.1X authentication on Junos EX Series switches? (Choose three)

Select 3 answers
A.The supplicant must initiate EAP-TLS with mutual certificate validation.
B.The RADIUS server must return Tunnel-Type (Attribute 64), Tunnel-Medium-Type (Attribute 65), and Tunnel-Private-Group-ID (Attribute 81).
C.The VLAN returned by the RADIUS server must already be configured locally on the EX Series switch.
D.The RADIUS server must return the VLAN ID encoded inside a Vendor-Specific Attribute (VSA) using Cisco-AVPair format exclusively.
E.The switch port must be configured to allow dynamic VLANs or be configured as a trunk port capable of hosting the assigned VLAN.
AnswersB, C, E

Correct. Standard tunneling attributes are required for VLAN assignment.

Why this answer

Dynamic VLAN assignment requires the VLAN to exist locally, the RADIUS server to return Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID, and the port to be capable of dynamic VLAN membership.

Practice this question →
27
MCQhard

You are configuring captive portal on an EX Series switch using J-Web and CLI. Users are redirected to the captive portal page, but after successful authentication, they still cannot access the external network. Inspecting the routing table and firewall filters, what is the most likely reason for this post-authentication restriction?

A.The default gateway address specified in the captive portal profile is in a different routing instance.
B.The captive portal dynamic firewall filter was not removed from the interface due to a failure in receiving the RADIUS Change of Authorization (CoA) or accounting update.
C.The user's MAC address was not statically added to the bypass list of the captive portal profile.
D.The captive portal profile lacks a defined redirect URL for the external network gateway.
AnswerB

Correct. Post-auth requires removal of the redirect filter, usually triggered by CoA or successful radius acceptance.

Why this answer

After successful captive portal authentication, the switch must dynamically remove the local firewall filter that redirects traffic to the portal server. If CoA or dynamic VLAN assignment fails, the filter remains active.

Practice this question →
28
Multi-Selecthard

Which THREE parameters must be configured when implementing captive portal on an EX Series switch? (Choose three)

Select 3 answers
A.A captive portal profile specifying redirection URLs and authentication parameters.
B.A global RADIUS accounting policy with interim-interval set to zero.
C.Interface or VLAN bindings linking the captive portal service to specific ports.
D.A static NAT pool for translating client IP addresses to the captive portal server IP.
E.An access profile defining the authentication server group.
AnswersA, C, E

Correct. The captive portal profile dictates portal behavior and URLs.

Why this answer

Captive portal implementation requires an access profile, a captive portal profile with redirection URLs, and binding the captive portal profile to the target interfaces or VLANs.

Practice this question →
29
MCQmedium

You are configuring an EX Series switch for 802.1X authentication. You want to ensure that if a supplicant fails authentication, the port is moved into a specific guest VLAN. Where is the guest VLAN referenced within the dot1x interface configuration?

A.Under [edit access-control interface ge-0/0/1 fallback-vlan].
B.Under [edit access profile profile-name guest-vlan].
C.Under [edit vlans vlan-name dot1x-guest-access].
D.Under [edit protocols dot1x interface ge-0/0/1 guest-vlan vlan-name].
AnswerD

Correct. Guest VLANs are specified directly under the dot1x interface configuration.

Why this answer

Guest VLANs in Junos 802.1X configurations are assigned under the interface authentication options using the 'guest-vlan' statement.

Practice this question →
30
MCQhard

An enterprise network uses 802.1X authentication with dynamic VLAN assignment on EX Series switches. A client authenticates, and the RADIUS server returns both a VLAN name and a set of dynamic firewall filter names via RADIUS attributes (Filter-Id). When the client connects, the VLAN assignment works perfectly, but the firewall filters are not applied to the interface. What is the most likely cause?

A.The dynamic filter must be defined inside the global access profile instead of being returned by RADIUS.
B.The named firewall filters were not pre-configured and committed locally on the EX Series switch.
C.RADIUS Filter-Id attributes are not supported on EX Series switches for dynamic firewall application.
D.Dynamic filter assignment requires MAC RADIUS and is not supported with 802.1X.
AnswerB

Correct. Dynamic filters referenced by RADIUS Filter-Id must exist locally on the switch.

Why this answer

For dynamic Filter-Id attributes returned by RADIUS to be applied successfully on an EX Series switch, the named firewall filters must already be pre-configured and committed locally on the switch. If the filter does not exist locally, the application fails.

Practice this question →
31
MCQeasy

Which Junos command displays the status of all captive portal sessions currently active on an EX Series switch?

A.show system captive-portal sessions
B.show access captive-portal clients
C.show ethernet-switching captive-portal table
D.show dot1x captive-portal summary
AnswerB

Correct. This command lists active captive portal client sessions.

Why this answer

The command 'show access captive-portal clients' displays active captive portal sessions and their status.

Practice this question →
32
MCQhard

An enterprise deploys 802.1X with dynamic VLAN assignment. When a user authenticates, the RADIUS server returns the correct VLAN name, but the switch places the port into a different VLAN. Upon checking the switch, you find that the VLAN name returned by RADIUS does not match any VLAN configured in the local 'vlans' configuration hierarchy. How does Junos OS handle this discrepancy?

A.The switch ignores the RADIUS attribute and keeps the port in its previous static configuration.
B.The switch dynamically creates the VLAN on the fly using default IEEE 802.1Q parameters.
C.The switch queries the VTP/GVRP server to dynamically learn the VLAN definition.
D.The switch drops the port into the default native VLAN or rejects the connection if strict VLAN enforcement is enabled.
AnswerD

Correct. Missing local VLAN definitions cause fallback behavior or rejection.

Why this answer

If a RADIUS server returns a VLAN name that does not exist locally on the EX Series switch, the switch drops the port into the default configured fallback or access VLAN (or rejects the connection depending on strict-vlan enforcement).

Practice this question →
33
MCQmedium

You are configuring an EX Series switch to use MAC RADIUS authentication. You notice that when devices connect, the switch sends authentication requests, but the accounting start packets are not being sent. What configuration is missing?

A.You must enable accounting globally using [edit system accounting radius].
B.You failed to enable accounting under the [edit protocols dot1x accounting] hierarchy.
C.You did not configure the accounting server and enable accounting under the access-profile hierarchy.
D.MAC RADIUS does not support accounting; accounting is exclusive to 802.1X.
AnswerC

Correct. Access profile accounting configuration is required for accounting packets.

Why this answer

To enable accounting along with MAC RADIUS, you must explicitly enable accounting under the access profile associated with the interface.

Practice this question →
34
MCQmedium

You are configuring a captive portal on an EX Series switch. You want to ensure that specific management traffic and critical server subnets are accessible to clients *before* they authenticate through the captive portal. Which configuration feature accomplishes this?

A.RADIUS dynamic authorization profiles with pre-auth attributes.
B.Captive portal firewall exemption filters or walled garden (bypass) configuration.
C.Global access profile authentication-bypass statements.
D.Static MAC bypass configuration under the protocols dot1x hierarchy.
AnswerB

Correct. Walled garden or bypass settings permit pre-auth traffic to specific IP ranges.

Why this answer

Pre-authentication access lists or firewall filters / bypass lists allow traffic to specific destinations before captive portal authentication occurs.

Practice this question →
35
MCQmedium

You are troubleshooting an issue where an 802.1X supplicant on a Windows client fails to connect to an EX Series switch port. The switch logs show 'EAPOL-TIMEOUT' errors. What does this error indicate?

A.The switch did not receive an EAPOL response from the client after sending an EAPOL request.
B.The RADIUS server took too long to validate the client credentials and dropped the session.
C.The switch port's operational mode reverted from access to trunk, dropping EAPOL frames.
D.The client sent an invalid EAP message that failed integrity checks.
AnswerA

Correct. EAPOL timeout signifies a lack of response from the supplicant to the switch's EAPOL messages.

Why this answer

An EAPOL-TIMEOUT error indicates that the switch sent an EAPOL packet (such as EAPOL-Request/Identity) but did not receive a response from the client within the timeout window.

Practice this question →
36
Multi-Selectmedium

Which TWO options are valid authentication methods that can be specified in the 'authentication-order' statement on an EX Series switch interface? (Choose two)

Select 2 answers
A.mac-radius
B.kerberos
C.tacacs-plus
D.dot1x
E.ldap-direct
AnswersA, D

Correct. Mac-radius is a valid authentication order method.

Why this answer

The authentication-order statement supports methods such as dot1x, mac-radius, and captive-portal.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Layer 2 Authentication And Access Control questions.

Start 20-question session