How to authenticate endpoints lacking 802.1X supplicant support?
Which mechanism can be used to enforce network access authentication against an AAA server if the endpoint does not support the 802.1X supplicant functionality?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests knowledge of 802.1X fallback methods; the common trap is confusing MAB with port security or WebAuth, which do not perform AAA server authentication in the same way.
When endpoints cannot run an 802.1X supplicant, MAC Authentication Bypass (MAB) allows the switch to authenticate the device against an AAA server using its source MAC address. The community unanimously confirms MAB as the correct fallback mechanism for non-802.1X-capable devices.
Option D (port security) is often chosen because it also uses MAC addresses, but port security only limits MAC learning on a port and does not authenticate against an AAA/RADIUS server.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
MAC Authentication Bypass (MAB) sends the endpoint's source MAC address to a RADIUS/AAA server as the username and password when the device cannot participate in 802.1X EAP exchanges. The AAA server validates the MAC against its database and returns an accept or reject decision, effectively providing network access authentication without a supplicant. This makes MAB the standard Cisco-recommended fallback for printers, IP phones, and IoT devices that lack 802.1X support.Why the Other Options Are Wrong
MACsec (B) provides link-layer encryption but does not perform authentication against an AAA server; it typically relies on 802.1X for key exchange. Private VLANs (C) isolate traffic within a VLAN but offer no authentication capability whatsoever. Port security (D) restricts which MAC addresses may use a switch port but operates locally on the switch and never communicates with a RADIUS/AAA server, so it cannot enforce centralized authentication.Community Comment Notes
Comment [1] correctly highlights that MAB offers lower security than 802.1X because MAC addresses can be spoofed, and notes that WebAuth is another viable fallback for devices with a browser. Comment [2] provides a useful NetworkLessons reference for MAB configuration details. Comment [3] reinforces the unanimous community agreement on option A.Official Reference
Exam Strategy
When a question mentions 'no supplicant' or 'non-802.1X endpoint,' immediately look for MAC Authentication Bypass or Web Authentication as the answer. Eliminate options that operate locally (port security, private VLANs) because the question explicitly requires AAA server authentication.
Related Analysis
Practice All 350-401 Questions
Access 218 questions with complete answers and detailed explanations.
View Full 350-401 Practice Test →