Network Access Control (NAC)

Network Access Control decides whether a device may join the network at all, checking identity and security posture before a port or wireless association carries any traffic. The usual machinery is 802.1X: the connecting device (supplicant) presents credentials to the switch or access point (authenticator), which relays them to an authentication server, typically RADIUS. Posture checks then verify whatever policy demands: patch level, antivirus state, disk encryption, whether the device is corporate-managed at all.

The design choice the exam probes is agent versus agentless. An installed agent gives deep, continuous posture detail but cannot cover guests, personal phones, printers, or IoT gear; agentless assessment scans or profiles those unmanaged devices at the cost of depth. Failure is not a flat rejection: non-compliant devices land in a quarantine or remediation VLAN with just enough access to fetch patches, and guests get an internet-only segment. NAC authenticates the device and its health, complementing multi-factor authentication, which authenticates the user.

Exam relevance: if a scenario checks a laptop’s patch level before letting it join, or shunts an unhealthy device into a remediation VLAN, the answer is NAC; 802.1X is the port-based mechanism beneath it. Contrast MFA, which proves who the user is; NAC decides whether the device itself is fit to connect.