312-50 Question 271
Single answer▪ Evading NAC and Endpoint SecurityDuring an authorized internal penetration test, a consultant plugs a laptop into an unused office network port. The switch places the device in a remediation VLAN because Network Access Control (NAC) requires a corporate-managed endpoint with a valid machine certificate and a passing posture check from the endpoint security agent. The consultant is not permitted to tamper with production endpoints or steal credentials, but is allowed to assess whether NAC can be bypassed through network-based weaknesses. Which action is the most appropriate and realistic next step to test for a NAC evasion weakness within scope?
- A
Passively capture and analyze 802.1X/EAP traffic and determine whether the port can be authenticated only by relaying or reusing a machine identity already present on the wire, if such testing is explicitly authorized
- B
Disable the endpoint security agent service on a nearby employee workstation and connect that workstation's MAC address to the tester's laptop to inherit its NAC trust state
- C
Flood the switch with forged MAC addresses until port security fails open, then request a DHCP lease and continue testing on the production VLAN
- D
Spoof the IP address of a known domain-joined host and send periodic ARP replies so the NAC system assumes the tester's laptop is the approved endpoint
Show answer and explanation
Correct answer: A
Explanation
The key to this scenario is separating legitimate NAC evasion testing from actions that are out of scope or based on incorrect assumptions. Enterprise NAC platforms commonly use IEEE 802.1X for port-based access control, often with EAP-TLS or PEAP for authentication, and may integrate posture assessment from an endpoint security or compliance agent before granting full network access. In such environments, simply spoofing a MAC or IP address is usually insufficient because authorization is tied to the authenticated session and, frequently, to device certificates and health status. The most realistic in-scope approach is to evaluate whether the NAC design is vulnerable at the network layer, such as through weaknesses in EAP handling, relay opportunities, or misconfigurations in 802.1X enforcement, but only with explicit authorization because these tests can affect production authentication flows. This approach is consistent with best practices described in IEEE 802.1X port-based access control guidance and vendor NAC deployment documentation, which emphasize strong EAP methods, certificate validation, posture enforcement, and protections against unauthorized session reuse.
- A. Correct.
Correct. This is the most appropriate next step because it focuses on assessing a network-based weakness in NAC enforcement rather than tampering with endpoints or stealing credentials. In real environments, NAC commonly relies on 802.1X with EAP methods and sometimes combines certificate-based authentication with posture checks. If the assessment scope explicitly allows it, examining whether authentication can be relayed, replayed, or otherwise abused at the network layer is a realistic way to test NAC resilience. This aligns with the scenario's constraint that the tester may assess bypass through network weaknesses but may not interfere with production endpoints.
- B. Incorrect.
Incorrect. Although cloning a MAC address is a common misconception about bypassing NAC, modern NAC deployments that require 802.1X machine authentication and endpoint posture do not rely only on MAC identity. More importantly, this option violates scope because it involves disabling security software on a production workstation. That is endpoint tampering, not a network-only test.
- C. Incorrect.
Incorrect. MAC flooding targets switch CAM table behavior, not NAC logic. It is noisy, disruptive, and generally out of scope for a controlled NAC evasion assessment unless explicitly approved as a denial-of-service style test. Even if successful on poorly configured equipment, it would not realistically satisfy 802.1X machine certificate and posture requirements. This distractor reflects the misconception that layer-2 attacks automatically bypass NAC.
- D. Incorrect.
Incorrect. NAC decisions are not typically based on IP address ownership alone. Spoofing an IP and sending ARP traffic may create conflicts or impersonation issues on the LAN, but it does not provide a valid 802.1X/EAP authentication state, machine certificate, or endpoint posture result. This option is plausible to someone confusing basic LAN impersonation with NAC authorization, but it would not normally move the tester out of the remediation VLAN.