Cisco CCNP Security Core (SCOR) 350-701Endpoint Security and Secure Network AccessMedium
A network security team is deploying a new secure network access solution for its campus network. The solution needs to dynamically assign users to specific VLANs and apply different access policies based on their authentication credentials and the health status of their endpoint device. Which component of an 802.1X deployment is responsible for communicating the authorization decision, including VLAN assignment, back to the network access device?
- AAuthentication Server
- BAuthenticator
- CDomain Name System (DNS)
- DSupplicant
Show answer & explanationAnswer & explanation
Correct answer: A. Authentication Server
In an 802.1X deployment, the Authentication Server (e.g., Cisco ISE, RADIUS server) is responsible for processing authentication requests, making authorization decisions (including VLAN assignment or access policies), and communicating these decisions back to the Authenticator (the switch or access point).
Why the other options are wrong
- B. The Authenticator (e.g., network switch) forwards authentication requests to the Authentication Server and enforces the policies received from it, but does not make the authorization decision itself.
- C. DNS translates domain names to IP addresses and is not directly involved in 802.1X authentication or authorization decisions.
- D. The Supplicant is the client device requesting network access, not responsible for communicating authorization decisions.
802.1X Authentication Server
The 802.1X Authentication Server (e.g., RADIUS server, Cisco ISE) is the central authority that validates user/device credentials and dictates network access policies, including VLAN assignment.
- Receives authentication requests from the Authenticator.
- Validates user/device identity against a database (e.g., Active Directory).
- Makes authorization decisions based on identity, roles, and posture.
- Communicates authorization results (e.g., VLAN, ACLs) back to the Authenticator.
Memory trick: The 'Server Says Yes/No' to network access.