Endpoint and Access Security (HiSec/campus scenarios)
This domain tests NAC, 802.1X, Portal, and MAC authentication in Huawei campus designs. Questions ask which access method fits a device or user type.
Core rules
- 802.1X uses a supplicant and EAP; it is strong for managed PCs but needs client configuration.
- Portal authentication redirects users to a web page; it suits guests and BYOD.
- MAC authentication authenticates by MAC address; it is useful for printers and cameras that cannot run a supplicant.
- HiSec/Agile Controller-Campus can combine authentication, posture assessment, and authorization.
- Authorization can place users in different VLANs or ACLs after authentication.
Worked example
A campus needs wired access for employee domain PCs, guest laptops, and IP phones. Use 802.1X for employees, Portal for guests, and MAC authentication for phones. Reasoning: each method matches endpoint capability. Forcing 802.1X on guests creates support load because they lack a configured supplicant. Posture results then map to an authorization policy.
Traps that cost marks
- Using Portal for devices with no browser.
- Assuming MAC authentication is strong security.
- Forgetting that posture results must map to authorization.
- Mixing authentication methods without a clear per-device policy.