The hospital's radiology wing has a mix of staff workstations that can run 802.1X and older imaging viewers that cannot. The deployment technician wants 802.1X attempted first on every port, with devices that don't respond falling back to a hardware-address check instead of being denied outright. What is this fallback behavior called?
Select an answer to reveal the explanation.
Short Explanation
It's like trying the front door first, and if nobody answers, checking the name on the mailbox instead of leaving the delivery on the step. Ordering 802.1X first and letting non-responsive devices fall back to MAC authentication keeps both modern and legacy clients on the network without opening it up wide.
Full Explanation
Authentication fallback ordering lets a port or SSID attempt the stronger method first, 802.1X, and only drop to a weaker method, MAC authentication, when the connecting device never responds to the 802.1X exchange at all, which is exactly the signature of a legacy imaging viewer with no supplicant. This preserves stronger per-user authentication for every device capable of it while still onboarding equipment that physically cannot participate in an EAP exchange, rather than forcing an all-or-nothing choice for the whole port. Spanning-tree fallback is not a real authentication concept; spanning tree is a Layer 2 loop-prevention protocol with no role in verifying identity. DHCP failover describes redundant DHCP servers backing each other up for address leasing, unrelated to authentication order. VLAN pruning trims which VLANs are allowed across a trunk link, a completely different, purely Layer 2 forwarding concern. When validating this configuration, connect a legacy device that cannot do 802.1X and confirm it authenticates via MAC check within the expected timeout rather than sitting unauthenticated indefinitely waiting for an 802.1X response that will never come.