N10-009 Question 273
Single answer4.3 Given a scenario, apply network security features, defense techniques, and solutions.A company allows employees to connect their own laptops to unused wall ports in conference rooms. After a recent security review, the network administrator discovers that several unknown devices were able to obtain IP addresses and reach internal file servers when plugged into these ports. The company wants to prevent unauthorized devices from gaining network access through wired connections while minimizing changes for approved corporate laptops. Which solution would BEST address this requirement?
- A
Implement 802.1X port-based network access control with a RADIUS server
- B
Disable DHCP and assign static IP addresses to all corporate laptops
- C
Configure an ACL on the router to block traffic from the conference room VLAN to the internet
- D
Enable NAT on the access switches for conference room ports
Show answer and explanation
Correct answer: A
Explanation
The best answer is implementing 802.1X with a RADIUS server because the scenario calls for a control that prevents unauthorized wired devices from gaining access when plugged into open wall ports. This is a classic use case for port-based Network Access Control (NAC). In enterprise practice, switches act as authenticators, endpoints act as supplicants, and a RADIUS server such as Microsoft NPS or Cisco ISE performs authentication and policy decisions. If authentication succeeds, the port is authorized; if not, the device can be denied access or placed into a restricted guest or remediation VLAN depending on policy. By contrast, disabling DHCP is a common but weak misconception because IP assignment is not the same as access control. Router ACLs and NAT do not directly solve the problem of unauthenticated endpoint attachment. This aligns with common vendor guidance and IEEE 802.1X best practices for securing edge ports in enterprise wired networks.
- A. Correct.
Correct. IEEE 802.1X provides port-based network access control, requiring a device or user to authenticate before the switch port grants normal network access. In a wired environment, this is a standard way to prevent unauthorized devices from simply plugging into an open jack and reaching internal resources. When integrated with a RADIUS server, approved corporate laptops can authenticate with certificates or credentials, which meets the requirement to minimize impact on authorized users while blocking unauthorized endpoints.
- B. Incorrect.
Incorrect. Disabling DHCP does not prevent unauthorized devices from connecting to the network; an attacker or unauthorized user could still manually configure a static IP address, subnet mask, gateway, and DNS settings if they can determine the network information. This option also creates significant administrative overhead for legitimate users and does not provide actual access control at the switch port.
- C. Incorrect.
Incorrect. Blocking internet access from the conference room VLAN does not solve the stated problem, which is unauthorized access to internal file servers. In fact, the scenario specifically identifies internal resource access as the issue. An ACL could be part of a broader segmentation strategy, but by itself it does not authenticate devices before they join the network and is therefore not the best solution.
- D. Incorrect.
Incorrect. NAT translates addresses and is commonly used at network boundaries, but it does not authenticate or authorize devices at a switch port. Enabling NAT on access switches for conference room ports would not stop an unauthorized device from connecting to the local network and would not be an appropriate control for this use case.