SY0-701 Question 336
Single answerNetwork access control (NAC)A company is rolling out a network access control (NAC) solution to reduce the risk of unmanaged devices connecting to the corporate LAN. The security team wants corporate laptops that meet security requirements to receive normal network access, contractor laptops to receive Internet-only access, and any device that fails posture checks to be placed on a remediation network where updates can be installed. Which solution best meets these requirements?
- A
Configure 802.1X authentication with dynamic VLAN assignment based on user/device identity and posture assessment results
- B
Deploy a port mirror on access switches so the NAC platform can observe traffic and manually alert administrators about noncompliant devices
- C
Use MAC address filtering on each switchport to allow corporate laptops and deny all other devices from connecting
- D
Implement a VPN concentrator that requires multifactor authentication before devices can reach internal network resources
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use 802.1X with NAC-driven posture assessment and dynamic authorization. NAC is intended to make access decisions based on identity and device health, then enforce those decisions through mechanisms such as dynamic VLAN assignment, downloadable ACLs, or quarantine/remediation networks. This is a common enterprise approach for controlling wired and wireless access. IEEE 802.1X provides the framework for port-based authentication, while a RADIUS server and NAC platform can evaluate credentials and posture before assigning appropriate access. This aligns with widely accepted best practices from network access control vendors and IEEE 802.1X-based deployments: authenticate first, assess device compliance, then grant least-privilege network access or isolate noncompliant devices for remediation.
- A. Correct.
Correct. 802.1X is a standard method for port-based network access control and is commonly integrated with a RADIUS server and NAC platform. In this design, the NAC solution can authenticate users or devices, evaluate posture information such as patch level or endpoint protection status, and then apply authorization decisions such as placing compliant corporate devices on a production VLAN, assigning contractors to a restricted VLAN, or moving noncompliant systems to a remediation network. This directly addresses identity-based access and posture-based segmentation.
- B. Incorrect.
Incorrect. Port mirroring is useful for monitoring and analysis, but it does not enforce admission control. A NAC solution needs a mechanism to permit, deny, or restrict access at connection time. Simply observing traffic and generating alerts would not automatically place endpoints into production, contractor, or remediation networks.
- C. Incorrect.
Incorrect. MAC filtering is a weak access-control method because MAC addresses can be spoofed and switch-by-switch administration does not scale well. It also does not evaluate endpoint posture, so it cannot distinguish between a compliant corporate laptop and one that is missing required updates. This option reflects a common misconception that device identification alone is sufficient for NAC.
- D. Incorrect.
Incorrect. A VPN concentrator can control remote access, but the scenario is about devices connecting to the corporate LAN. VPN with MFA does not provide port-based admission control for local switch connections, nor does it typically assign endpoints to remediation networks based on LAN posture checks. It addresses a different access path.