An organization uses 802.1X for network access control. An attacker attempts to connect an unauthorized laptop to a wired port. Which 802.1X behavior BEST prevents unauthorized access?

B is correct because 802.1X in enforcing mode blocks all traffic from unauthenticated supplicants, preventing any network access until credentials are validated. A is wrong because assigning to guest VLAN still grants some network access, which may not be appropriate. C is wrong because logging and alerting are detective controls that do not prevent the initial access. D is wrong because rate limiting still allows some traffic, which could be exploited.