350-401 Question 303
Select 2An enterprise network is implementing network access control on its wired switches. The goal is to ensure only authenticated devices can gain network access using 802.1X, but some legacy devices do not support 802.1X. The network administrator has configured fallback mechanisms to provide controlled access for these legacy devices. Which combination of mechanisms should the administrator use to achieve this?
- A
Configure 802.1X for devices that support it, and use MAC Authentication Bypass (MAB) for legacy devices.
- B
Use WebAuth as the sole authentication mechanism for all devices.
- C
Enable 802.1X for capable devices and configure WebAuth as a fallback for legacy devices.
- D
Rely solely on MAC Authentication Bypass (MAB) for all devices, including 802.1X-capable ones.
- E
Combine 802.1X for authentication and implement WebAuth for guest access.
Show answer and explanation
Correct answers: A, C
Explanation
802.1X is the most secure method for authenticating devices and should be used wherever possible. For devices that do not support 802.1X, fallback mechanisms such as MAB or WebAuth can be configured to provide controlled access. Using both 802.1X and a fallback mechanism like WebAuth ensures a secure and flexible approach that accommodates a variety of device capabilities in the network.
- A. Correct.
This is correct because 802.1X is the primary mechanism for capable devices, while MAB can provide fallback for devices unable to use 802.1X.
- B. Incorrect.
This is incorrect because WebAuth is not suitable as the sole mechanism for network access control in environments where 802.1X can be utilized. It is better suited for guest networks or fallback scenarios.
- C. Correct.
This is correct because combining 802.1X for capable devices and WebAuth for legacy devices provides a flexible approach to network access control.
- D. Incorrect.
This is incorrect because relying solely on MAB does not leverage the stronger security provided by 802.1X for capable devices.
- E. Incorrect.
This is partially correct conceptually, but it does not address the use of WebAuth as a fallback specifically for legacy devices that cannot use 802.1X.