An infusion pump on the med-surg ward has no way to run an 802.1X supplicant, but it still needs to authenticate onto the wired network port it's plugged into. Which authentication method is intended for exactly this kind of client?
Select an answer to reveal the explanation.
Short Explanation
Not every device on a hospital network can hold a conversation with the network the way a laptop can. When a device can't speak 802.1X at all, MAC authentication steps in as the fallback: the network checks the device's hardware address against a known list instead of asking it to prove anything.
Full Explanation
MAC authentication exists for headless or embedded devices that lack an 802.1X supplicant and cannot be configured to run one, which describes most biomedical equipment: infusion pumps, patient monitors, and nurse-call stations ship with fixed firmware that has no concept of EAP. The switch or controller checks the connecting device's MAC address against an authorized list or a RADIUS-backed lookup and grants access if it matches, without any interactive credential exchange. WPA3-Personal requires entering a passphrase, which assumes an interface and a user present to type it, neither of which a pump provides. An 802.1X machine certificate assumes the device has a supplicant capable of presenting that certificate during an EAP exchange, which is precisely what this pump lacks. A captive portal depends on a web browser rendering a login page, and embedded medical devices have no browser to redirect. The tradeoff worth knowing operationally is that a MAC address can be spoofed, so MAC-authenticated ports are typically paired with a restrictive role limiting the device to only the servers or VLANs it legitimately needs, and a quick validation is confirming the pump lands on its intended VLAN, not just that it gets network access at all.