A law office wants each wall port to forward no user traffic until the attached laptop authenticates with a user certificate against the office RADIUS server. Which control provides that?
Select an answer to reveal the explanation.
Short Explanation
You want the wall port to stay shut until the laptop proves who is behind it. That gate is 802.1X, with the switch asking RADIUS to check the certificate before user traffic flows. Counting MAC addresses, or learning the first MAC and opening the port, never checks the certificate.
Full Explanation
IEEE 802.1X is port-based network access control. The switch places the port in an unauthorized state, allows only the authentication exchange, and opens user traffic after a RADIUS server accepts the credentials, such as a user certificate. That is the behavior the law office described. Port security limits how many MAC addresses may appear on a port and can shut the port on a violation. A MAC address is an interface identifier, not a user identity, so a one-MAC limit does not check a certificate. A MAC allow-list has the same weakness. Burned-in addresses can be spoofed, and the list never asks RADIUS to validate a certificate. Port security that learns the first MAC and forwards immediately is the near miss, because the port does end up restricted to one machine, and user traffic flows before any certificate is accepted. The stem forbids that. Exam caveat: 802.1X needs a supplicant on the laptop, a switch that can act as the authenticator, and a reachable RADIUS server. A certificate alone does nothing if the client has no supplicant. Operational check: connect an unauthenticated laptop and confirm the port stays unauthorized and receives no user VLAN traffic, then present the certificate and confirm RADIUS accepts it and the port opens.