A large hospital deploys label printers and SIP handsets that run without any 802.1X supplicant installed. The access switches enable 802.1X with MAB as the alternate method after the EAP exchange times out, and the printers must land on a restricted VLAN with a downloadable ACL. Which MAB identification step does the switch perform for these endpoints?
Select an answer to reveal the explanation.
Short Explanation
When your printer can’t respond to EAP, the switch uses its MAC address like a name tag: it sends a RADIUS Access-Request with that address in the user name field. That’s MAB identification, letting your network assign the endpoint to the right restricted VLAN and ACL.
Full Explanation
With MAB, the switch uses the endpoint’s MAC address as the identity in a RADIUS Access-Request; the RADIUS policy can then authorize access and return the restricted VLAN and downloadable ACL. EAP-TLS is a sound certificate-based 802.1X method and can deliver those same policies, but it requires an EAP supplicant and usable device credentials, which these endpoints lack. DHCP-based profiling can identify devices and inform RADIUS policy, but learning a MAC from DHCP is not the MAB authentication step; it also depends on DHCP traffic and does not replace the stated fallback after EAP times out. A local MAC-to-port table with a locally applied ACL is a possible small-scale access-control design, but it does not obtain the required downloadable ACL from the authorization service. Exam caveat: vendors differ in whether the MAC is formatted with separators or used as the RADIUS password as well as the user name; those details do not change the defining MAB identity in this question. Practical check: capture or inspect the switch’s RADIUS transaction for a test endpoint and confirm that its MAC appears as the user name and that the Access-Accept supplies the intended VLAN and downloadable ACL.