Only corporate laptops that are authenticated and meet current patch and endpoint-protection requirements may connect to the wired network; non-compliant devices must be kept off until they are fixed. Which network access control approach meets this requirement?

IEEE 802.1X provides port-based network access control: a switch port remains closed until the connecting device authenticates through an authentication server, usually with certificates or credentials tied to corporate devices. Adding an endpoint posture or compliance check evaluates the device's state, such as patch level and endpoint protection status, before full access is granted, and non-compliant devices can be denied or placed in a remediation network until fixed. Together they enforce both identity and health, which is exactly what the requirement specifies. A captive portal intercepts web traffic and requires users to accept terms or sign in, which suits guest wireless access but does not authenticate the device cryptographically or evaluate its patch and protection status. MAC address filtering admits devices whose hardware addresses are on a list, but MAC addresses are easily observed and spoofed, and the filter checks nothing about compliance. Disabling unused switch ports reduces opportunities for rogue connections, yet any active port remains open to whatever device is plugged into it, compliant or not. Exam caveat: devices that cannot run 802.1X, such as some printers, need a documented alternative like a restricted VLAN rather than an exception that bypasses control. Operational check: connect a corporate laptop with endpoint protection disabled and confirm it is placed in remediation, then restore compliance and confirm full access is granted.