SY0-701 Question 337
Single answerNetwork access control (NAC)A company is rolling out network access control (NAC) for all wired and wireless connections. The security team wants corporate laptops that meet security requirements to receive normal network access automatically. Employee-owned devices and any corporate device that is missing critical patches or endpoint protection should be prevented from reaching internal resources, but users still need access to a remediation portal to update their systems. Which solution best meets these requirements?
- A
Configure NAC to perform posture assessment during authentication and place noncompliant or unknown devices into a remediation VLAN with restricted access
- B
Implement MAC filtering on switch ports and wireless access points so that only known device addresses can connect to the network
- C
Deploy a network-based intrusion detection system (NIDS) to identify unpatched hosts and automatically alert the help desk
- D
Require all users to connect through a VPN before accessing any internal resource, and deny VPN access to devices that are not domain-joined
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use NAC with posture assessment and dynamic network segmentation, such as assigning noncompliant or unknown devices to a quarantine or remediation VLAN. NAC commonly integrates with 802.1X, RADIUS, and endpoint posture checks to determine whether a system should receive full, limited, or denied access. This supports a real-world policy of allowing compliant managed devices onto production networks while isolating devices that are unmanaged or fail health checks.
MAC filtering is not considered strong security because MAC addresses are trivial to spoof and do not indicate device health. A NIDS is valuable for visibility and alerting but is not an admission control technology. VPN enforcement can complement NAC for remote access, but it is not the best fit for controlling local wired and wireless network onboarding with remediation access.
This approach aligns with common NAC best practices described by enterprise NAC vendors and with security guidance that recommends checking endpoint health before granting access and using network segmentation to contain noncompliant systems until they are remediated.
- A. Correct.
This is correct. NAC is designed to evaluate endpoint identity and security posture, such as patch level and endpoint protection status, before or during network admission. A remediation VLAN or quarantine network is a standard NAC approach that limits access to internal resources while still allowing access to update servers, patch repositories, or a captive remediation portal. This directly satisfies the requirement to allow compliant corporate laptops normal access while isolating noncompliant or unknown devices.
- B. Incorrect.
This is incorrect. MAC filtering provides only weak device identification and is easily bypassed through MAC spoofing. It also does not assess device posture, such as whether patches or endpoint protection are current. Someone might choose this option because it can restrict connectivity, but it does not provide the compliance-based, remediation-focused control that NAC is intended to deliver.
- C. Incorrect.
This is incorrect. A NIDS can detect suspicious traffic or patterns and generate alerts, but it does not function as an access control mechanism for admission to the network. It also would not normally place systems into a restricted remediation segment. This option reflects the misconception that detection tools can replace preventive access enforcement.
- D. Incorrect.
This is incorrect. VPN solutions can enforce some device checks depending on the implementation, but requiring VPN for all internal access does not address wired and wireless LAN admission in the same way NAC does. Denying access to non-domain-joined devices also fails the stated requirement to provide limited remediation access. Someone might pick this because VPN posture checks exist, but NAC is the more appropriate network admission solution for this scenario.