A network printer authenticates with MAB through Cisco ISE. An attacker unplugs it and connects a laptop configured with the printer's MAC address to the same port. Which design limits the damage of this attack?
Select an answer to reveal the explanation.
Short Explanation
MAB is just checking the name tag, and anyone can wear a fake name tag. So you assume it'll get faked and make sure the tag only opens the printer door. Tightly scoped authorization, plus profiling that notices a laptop acting un-printer-like, is your safety net.
Full Explanation
MAC authentication bypass trusts a MAC address only, and MAC addresses are trivial to spoof. Because MAB cannot prove device identity, the design goal is to limit what a MAB-authenticated endpoint can reach. Profiling classifies the device from attributes such as DHCP options, CDP or LLDP and traffic behavior, and authorization returns a printer-only profile, such as a dACL that permits print protocols to the print servers and little else. A laptop impersonating the printer gains only that narrow access, and profiling may detect the change in attributes and trigger a reprofile with a change of authorization. Moving a headless printer to PEAP with an operator-entered password is impractical and does not match the device type. Lengthening the 802.1X timeout changes only how long the switch waits before falling back to MAB; the attacker still authenticates with the spoofed MAC. Disabling RADIUS accounting removes visibility and profiling data from ISE and makes detection harder, not easier. Exam caveat: if a printer supports certificates, EAP-TLS is stronger than MAB, but the exam expects you to know MAB itself is weak. Operational check: from a test laptop using a printer's MAC, verify that only print traffic to the approved servers succeeds.