A hospital wants staff laptops joining the clinical Wi-Fi to prove their identity with domain credentials before they get any network access, rather than just knowing a shared passphrase. Which authentication approach is designed for this kind of per-user identity check at association time?
Select an answer to reveal the explanation.
Short Explanation
Think of 802.1X like a badge reader at a hospital door: it checks who you are, not just that you know the building's four-digit code. A shared passphrase can't tell one nurse's laptop from another, but 802.1X ties the connection to an actual identity before it's let onto the network.
Full Explanation
802.1X is the port-based authentication framework built for exactly this scenario: the client (supplicant) presents credentials through an EAP exchange, the switch or AP (authenticator) relays that exchange, and a back-end authentication server validates the identity before the port or association is opened. Because the credential is tied to the person, a compromised or lost laptop doesn't hand an attacker a network-wide shared secret the way a WPA2-Personal passphrase would. A shared passphrase fails the requirement because every device authenticates with the same string, so there is no per-user identity involved at all. MAC authentication checks a hardware address rather than a person, and hardware addresses can be spoofed and don't map to who is actually using the device. An open SSID with only a captive portal delays the login prompt to the browser but still doesn't perform a cryptographic per-user handshake at association time the way 802.1X does. A useful operational check during deployment is confirming that a test laptop is prompted for domain credentials before it receives an IP address, not after.