A campus access port must authenticate laptops with 802.1X, but printers on the same port type have no supplicant. The engineer wants 802.1X tried first, then MAB if no EAP response arrives. What should be configured on the switch?
Select an answer to reveal the explanation.
Short Explanation
Think of it as knocking first: you have the switch ask for 802.1X credentials, and if nobody answers after the timeout, it falls back to checking the MAC. That way laptops get strong authentication and printers still get on. The trap is reversing the order and letting a spoofed MAC beat a laptop to the punch.
Full Explanation
On Cisco switches the authentication order defines the sequence of methods attempted on a port. With 802.1X first and MAB second, the switch sends EAP requests when a device connects; a supplicant-capable laptop responds and is authenticated with EAP against ISE. A printer does not respond, so after the 802.1X timeout expires the switch falls back to MAB, learns the MAC address from the first frame and sends it to ISE as the identity, where profiling and authorization decide access. Using MAB only would remove strong authentication from laptops and authenticate them by spoofable MAC addresses. Using 802.1X only with printer MAC addresses in an ACL bypasses ISE policy, does not authenticate printers at all, and is unmanageable at scale. Web authentication is a browser-based method for users, not appropriate as a first step for headless printers, and WebAuth is not part of this design. Exam caveat: authentication order and priority are distinct settings; priority determines whether a higher-priority method can interrupt a session already authenticated by a lower-priority one. Operational check: connect a printer and confirm the session shows 802.1X failed or timed out and MAB succeeded, then confirm a laptop authenticates with 802.1X.