Which Protocol Supports Certificate Authentication and Device Quarantine?

SY0-601 By islever Editorial Last updated

Short answer

A 802.1X provides port-based access control that supports certificate authentication, covers wired and wireless networks, and enables device quarantine.

Question

A systems administrator is redesigning how devices will perform network authentication. The following requirements need to be met: • An existing internal certificate must be used. • Wired and wireless networks must be supported. • Any unapproved device should be isolated in a quarantine subnet. • Approved devices should be updated before accessing resources. Which of the following would best meet the requirements?
  1. 802.1X Correct Answer
  2. EAP
  3. RADIUS
  4. WPA2

Key Takeaways

Tests 802.1X as the foundational NAC framework while trapping candidates who confuse it with underlying components like EAP or RADIUS.

This question tests port-based network access control using 802.1X for unified wired and wireless authentication. The explanation clarifies why 802.1X uniquely satisfies certificate integration, device quarantine, and compliance enforcement compared to standalone protocols.

Common mistake: Candidates often select RADIUS or EAP because they handle authentication, but these lack the built-in port-level access control and policy enforcement required for device quarantine and compliance checking.

Expert Analysis

Why the Answer Is Correct

802.1X is the IEEE standard for port-based network access control, making it the definitive choice for this scenario. It natively supports both wired and wireless connections, leverages internal PKI certificates through EAP-TLS, and serves as the foundation for integrating with Network Access Control (NAC) solutions. These integrations enforce the required policies for isolating unapproved devices into quarantine subnets and mandating updates before resource access.

Why the Other Options Are Wrong

EAP is merely an authentication framework that operates within 802.1X and does not manage port-level access or device compliance. RADIUS functions as the backend authentication server that validates credentials but lacks the inherent capability to isolate non-compliant endpoints or enforce pre-access updates. WPA2 is exclusively a wireless security protocol and cannot satisfy the requirement for wired network support.

Community Comment Notes

Learners overwhelmingly selected 802.1X, correctly recognizing it as the comprehensive framework rather than isolated components. As user brf2017 observed, "All answers provide some authentication but the best answer would be 802.1x" because only it fulfills every stated condition. Multiple verified test-takers confirmed that understanding 802.1X as the NAC backbone resolves the distractor confusion.

Exam Strategy

Focus on distinguishing the access control framework from its supporting protocols when reviewing Security+ practice questions. Memorize that 802.1X manages the physical or logical port state, while RADIUS and EAP simply validate credentials behind the scenes.

Frequently Asked Questions

Why isn't RADIUS the correct answer for network authentication here?

RADIUS handles backend authentication and accounting but lacks the port-level access control and policy enforcement required for device quarantine and compliance checks.

How does 802.1X work with internal certificates for authentication?

802.1X uses EAP-TLS to exchange internal PKI certificates between the supplicant and authenticator, ensuring mutual authentication before granting network access.

More SY0-601 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. 1403ad2 👍 9
    choose A 2024-20-2 On Test and passed with 80
  2. brf2017 👍 4
    All answers provide some authentication but the best answer would be 802.1x 802.1x meets all the requirements of the question. The other three: EAP, RADIUS and WP2 do not satisfy all question requirements.
  3. AspiringNerd 👍 2 Answered A
    A. 802.1X 802.1X can provide the foundation for network authentication, allowing devices to authenticate themselves before gaining access to the network. When used in conjunction with a robust NAC solution, it can also facilitate device isolation and update mechanisms to meet the specified requirements.
  4. johnabayot 👍 2 Answered A
    A. 802.1X meets all the coditions
  5. Imjusthere00 👍 2 Answered A
    A. 802.1X
Show 1 more comment
  1. Hs1208 👍 1 Answered A
    802.1X

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

MFA and Patch Management Control Type and Category

S-grade

Threat Hunting Data Sources for Exploitable Systems

S-grade

Full Weekly and Differential Daily Backup Strategy

S-grade

Access Auditing as the SaaS Vendor Risk to Focus On

S-grade

← Back to SY0-601 Study Guide