802.1X BYOD Access: Why NAC Beats ACLs and MAC Filtering

What the question is really asking The engineer is designing admission control for BYOD devices on a trusted wireless network using an 802.1X architecture. 802.1X supplies port-based authentication through a supplicant, an authenticator, and an authentication server, but BYOD adds requirements that plain authentication does not cover: device profiling, endpoint posture assessment, onboarding, and authorization policy. The control that integrates those functions with 802.1X is NAC, so the correct option is D. NAC can hold a device in a remediation or guest role until it satisfies policy, then admit it to the trusted WLAN.

Why the alternatives do not satisfy the architecture A, an ACL, is a traffic filter applied after access is granted; it can block subnets or ports but cannot authenticate a BYOD device or check posture. B, MAC filtering, relies on allow/deny lists of hardware addresses, which are easy to spoof and painful to maintain as employees change devices. C, port security, limits how many or which MAC addresses appear on a switch port, primarily on wired access ports; it is not a centralized BYOD admission or posture system. The supplied comment makes the same point: NAC works hand in hand with 802.1X to enforce policies, posture assessments, and device profiling for BYOD before secure access.

Adjacent decisions and what would flip the answer If the requirement were to restrict one wired switch port to a single known MAC address, port security would be the natural choice. If the task were to block specific IP addresses or TCP/UDP ports after admission, an ACL would fit. If the only goal were to allow known wireless client MAC addresses and nothing more, MAC filtering becomes plausible, though still weak identity. The phrase "BYOD devices must access a trusted wireless network securely" is what makes NAC the answer: it turns 802.1X authentication into an admission decision using identity, device health, and policy.

Operational consequence of choosing wrong Selecting an ACL, MAC filtering, or port security leaves the trusted WLAN without a posture or onboarding gate. An unpatched or compromised BYOD device could join the trusted network, and administrators would face manual MAC churn and inconsistent guest handling. NAC centralizes those checks, but a bad NAC rollout can also lock out legitimate users, so pilot the policy and provide a remediation or fallback path.