Network Access Control and Policy Enforcement
What this domain tests
This domain tests NAC concepts and enforcement: authentication, authorization, posture assessment, quarantine/remediation, and the roles of supplicant, authenticator, and authentication server. Expect 802.1X, EAP, RADIUS, MAB, guest VLANs, and agent vs agentless posture checks.
Core rules
- 802.1X roles: supplicant on the endpoint, authenticator on the switch or wireless controller, authentication server (typically RADIUS).
- Authentication proves identity; authorization decides access. Passing 802.1X does not mean the device is healthy.
- Posture assessment checks patch level, antivirus, disk encryption, or required agents before granting full access.
- Remediation/quarantine places a noncompliant device in a restricted VLAN or ACL with access only to remediation resources.
- MAB authenticates by MAC address when no supplicant exists; it is weaker because MAC addresses can be spoofed.
- Guest VLANs provide limited access with isolation and acceptable-use acknowledgment.
Worked example
A contractor laptop authenticates successfully but receives only remediation-portal access. Reasoning: authentication passed, so the issue is authorization or posture. Check the RADIUS authorization result and posture report. If the endpoint lacks the required antivirus update, NAC assigns the quarantine VLAN. The user updates the agent, the posture is rechecked, and the device is reauthorized into the corporate VLAN. Do not solve this by adding the user to a bypass group.
Traps
- Confusing authentication with posture compliance.
- Assuming VLAN assignment alone enforces all policy; ACLs may still be needed.
- Using MAB as a strong identity control.
- Forgetting that remediation access must be reachable from quarantine.
- Bypassing NAC for VIP devices without compensating controls.