ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

IEEE 802.1X enforces port-based network access control by requiring endpoints to complete an Extensible Authentication Protocol (EAP) exchange before the switch ever transitions the port to an active forwarding state. The switch (acting as the authenticator) relays the user or device credentials to a back-end RADIUS server, which grants or denies access. Because network connectivity- including DHCP requests- is blocked until authentication succeeds, unauthorized or rogue devices are prevented from joining the network.

DHCP snooping only validates DHCP transactions; it does not verify user or device identity and cannot stop an attacker who statically configures an IP address. MAC address filtering is labor-intensive and easily bypassed through spoofing. Moving unused ports to an isolated VLAN keeps them from reaching production networks but does not authenticate devices, and misconfiguration can still leave ports active. Therefore, enabling 802.1X with RADIUS is the most effective NAC control for the stated requirements.