802.1X Alone, or NAC? — TechKnowSurge

About this interactive

802.1X is a great starting point: a computer cannot reach the network until it authenticates. But that is all it checks. A machine full of viruses, or one that has not been patched, still gets on as long as its credentials or certificate are valid. Network access control, NAC, adds checks on the machine itself. Depending on the policy, it can confirm the operating system is patched, antivirus is up to date and has scanned recently, a vulnerability assessment has been run, or an IDS, IPS or EDR tool is in place. It can check before admission, after admission, or both: a post-admission check catches the laptop that was fine when it joined but has missed a new critical patch since. A machine that fails can simply be denied, or placed on a remediation network where it can fetch its updates and then try again. To sort a card, ask whether the check is about who the device or user is, which 802.1X handles, or about the state of the device, which needs NAC.

What you'll learn

Tell a check 802.1X makes on its own (proving the identity of a user or device) from one that needs NAC (the device's health: patches, antivirus, EDR, vulnerability assessment)
Recognize NAC's responses: checking before admission, re-checking after it, and sending a failing device to a remediation network

Aligned to

CompTIA Security+

4.5 Given a scenario, modify enterprise capabilities to enhance security.

3.2 Given a scenario, apply security principles to secure enterprise infrastructure.

Key terms

Network Access Control: Network Access Control enforces security policy on devices attempting to connect to a network, verifying compliance with posture requirements such as patch level, antivirus status, and certificate validity before granting access.
802.1X: An IEEE standard for port-based network access control that requires devices to authenticate before gaining access to a wired or wireless network, using a supplicant, authenticator, and authentication server (typically RADIUS). It is the foundation of enterprise Wi-Fi security and wired port security using EAP methods.
Remediation Network: An isolated network segment where non-compliant endpoints are placed to obtain updates or fixes before being granted access to the production network.
Endpoint Detection and Response: A security solution that continuously monitors endpoint devices to detect, investigate, and respond to threats.
Patch Management: The process of acquiring, testing, and installing software updates to fix vulnerabilities and improve functionality.

Topics

Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →