Skip to content
Study CCNP

5.4.b Endpoint security

2 min read ENCOR 350-401 v1.2 Updated

Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.

On this page

What this objective tests

This is a describe objective. The exam wants you to explain how a device earns network access and what it may reach after it connects. Endpoint security answers two questions: should this device join the network, and what should it reach?

The four access concepts

ConceptWhat it does
802.1XAuthenticates the endpoint or user before access. Uses EAP over the LAN.
MAC Authentication Bypass (MAB)Authenticates by MAC address. For devices with no 802.1X supplicant, such as printers.
PostureChecks endpoint health: patches, antivirus, disk encryption. Can change access after login.
ProfilingIdentifies the device type from its behavior. Feeds policy decisions.

802.1X is stronger than MAB. A MAC address is easy to spoof. Use MAB only for devices that cannot run a supplicant.

Endpoint connects
   |
   v
802.1X? -> yes -> authenticate user/device
   | no
   v
MAB -> authenticate MAC address
   |
   v
RADIUS (ISE) returns authorization: VLAN, ACL, or SGT

Example: dot1x with MAB fallback on SW1

Scenario: GigabitEthernet1/0/10 is a user port. Try 802.1X first. Fall back to MAB. Cisco Identity Services Engine (ISE) at 10.10.30.10 decides the result.

aaa new-model

radius server ISE-RADIUS-1
 address ipv4 10.10.30.10 auth-port 1812 acct-port 1813
 key 0 <shared-key>

aaa authentication dot1x default group radius
aaa authorization network default group radius

dot1x system-auth-control

interface GigabitEthernet1/0/10
 description User access port
 switchport mode access
 switchport access vlan 10
 authentication host-mode multi-auth
 authentication order dot1x mab
 authentication priority dot1x mab
 authentication port-control auto
 mab
 dot1x pae authenticator
 spanning-tree portfast

authentication order dot1x mab tries 802.1X first. authentication port-control auto keeps the port blocked until authorization succeeds.

Expected verification output:

SW1# show authentication sessions interface GigabitEthernet1/0/10
            Interface:  GigabitEthernet1/0/10
          MAC Address:  0050.56ab.1201
           IP Address:  10.10.10.51
               Status:  Authz Success
               Domain:  DATA
       Oper host mode:  multi-auth
     Oper control dir:  both
        Authorized By:  Authentication Server
          Vlan Policy:  10
      Session timeout:  N/A
         Idle timeout:  N/A
    Common Session ID:  0A0A0A02000000123ABC4567
      Acct Session ID:  0x00000045
               Handle:  0x2A000012

Runnable methods list:
       Method   State
       dot1x    Authc Success
       mab      Not run

Look for Status: Authz Success and the method state. dot1x Authc Success means 802.1X worked. mab Authc Success means the device used MAB fallback.

EDR and posture after admission

Endpoint Detection and Response (EDR) watches host behavior after the device is on the network. Network access control decides admission. They work together:

  • EDR detects suspicious behavior.
  • The identity system changes the endpoint authorization.
  • Network policy contains the endpoint.

Exam traps

  • Authentication success does not mean full access. Authorization decides the result.
  • MAB is weaker than 802.1X. MAC addresses are easy to spoof.
  • Posture can change access after the device connects.
  • Endpoint security is not only antivirus. It includes EDR, posture, and profiling.

Pass check

You are ready for this objective when you can do these things:

  • Explain 802.1X, MAB, posture, and profiling in one sentence each.
  • Explain why MAB exists and why it is weaker.
  • Read show authentication sessions and name the method, status, and VLAN.
  • Explain how EDR and network access control divide the work.

Related objectives