AAA, 802.1X, NAC, and Access Control Decisions Quick Reference for Network+ N10-009

Security answers often look interchangeable because several controls can appear in the same login or connection path. The quickest way to separate them is to ask what decision the control actually makes.

A user may authenticate through one service, receive network access through another control, and still be limited by an access control list (ACL) or security-zone policy after admission. The full Domain 4 Network Security guide teaches the complete attack-and-control model. This Quick Review focuses on the nearby answers most likely to blur together.

1. Access-control decision map

2. Separate authentication, authorization, and accounting

Authentication verifies a claimed identity. Authorization decides what that authenticated identity may do. Accounting records activity such as session time, usage, or administrative commands. Together they are commonly called authentication, authorization, and accounting (AAA).

The order matters in a scenario:

1. A user or administrator presents an identity.
2. The system verifies it.
3. Policy determines permitted actions.
4. Activity can be recorded for auditing or operational use.

A successful login does not imply unrestricted access. An administrator may authenticate successfully and still be authorized for only a limited set of commands. A remote employee may authenticate successfully and be assigned a restricted role or VLAN.

3. Use the access use case to separate RADIUS and TACACS+

Both Remote Authentication Dial-In User Service (RADIUS) and Terminal Access Controller Access-Control System Plus (TACACS+) can participate in centralized AAA. Their common Network+ use cases differ.

For Network+ questions, network admission points toward RADIUS; network-device administration often points toward TACACS+.

Do not reduce the distinction to a memorized port number. The scenario usually tells you which job must be performed.

4. Separate directory access from federation

Lightweight Directory Access Protocol (LDAP) and Security Assertion Markup Language (SAML) can both appear near identity systems, but they solve different problems.

LDAP

LDAP accesses directory information such as users, groups, devices, and attributes. An application or authentication service may query a directory to find identity information or group membership.

LDAP does not by itself mean:

• 802.1X network admission
• Browser-based federation
• Network-device command authorization
• Single sign-on across every connected application

SAML

SAML carries security assertions between an identity provider and a relying service. A common clue is browser-based federation or single sign-on between separate services.

The identity provider authenticates the user according to its own policy, then the relying application consumes the assertion and applies its authorization rules.

5. Know the three 802.1X roles

Institute of Electrical and Electronics Engineers (IEEE) 802.1X is port-based network access control. The three roles are worth learning as a traffic path rather than as isolated vocabulary.

• Supplicant: the endpoint requesting access.
• Authenticator: the switch or access point controlling the network edge.
• Authentication server: the service that evaluates the identity request, commonly through RADIUS in Network+ scenarios.

The authenticator controls the port or wireless access state. It does not usually make the final identity decision by itself.

A successful 802.1X exchange can result in more than simple allow/deny behavior. Policy may return a VLAN, role, access list, or other attributes. A failed exchange may leave access blocked, assign a guest or remediation role, or use a fallback method according to the design.

6. Choose among NAC, 802.1X, port security, and MAC filtering

These controls all influence network access, but they inspect different evidence.

A useful decision sequence is:

• Need identity-based admission at the edge? Think 802.1X.
• Need identity plus posture, role, remediation, or broader endpoint policy? Think NAC.
• Need to limit Layer 2 MAC behavior on one switchport? Think port security.
• Need only a simple MAC allow/deny list? Think MAC filtering, while remembering it is weak identity.

7. Use least privilege after identity is established

Authentication answers who the user or device claims to be. Least privilege answers how much access that identity should receive.

Role-based access control (RBAC) groups permissions around job or functional roles. A support technician may be allowed to view interfaces and bounce access ports without changing routing or security policy. A monitoring account may read counters without modifying configuration.

This is an authorization problem, not an authentication problem.

Useful scenario clues include:

• "Only these commands"
• "Read-only monitoring"
• "Temporary contractor role"
• "Users in this group"
• "Minimum required access"

Shared administrator accounts work against accountability because activity cannot be attributed cleanly to one person. Individual identities plus centralized authorization and accounting give stronger evidence.

8. Choose ACL, URL filtering, or content filtering from what must be inspected

After a device has network access, traffic still needs policy.

Rule order matters when ACLs are processed top to bottom. A broad permit placed before a narrow deny can make the deny ineffective.

When the scenario says "block TCP 22 from the guest network to management addresses," think network/transport policy such as an ACL or firewall rule. When it says "block gambling sites," think URL filtering. When it says "block executable attachments," think content inspection.

9. Use zones to define trust boundaries, then enforce the required flows

A trusted zone has a higher level of organizational control. An untrusted zone includes networks such as the public internet. A screened subnet places public-facing or externally reachable services in a separate zone between external and internal networks.

The zone name is not the control by itself. Routing, ACLs, firewall policy, management restrictions, and monitoring enforce the boundary.

A public web server in a screened subnet may need:

• HTTPS from the untrusted internet
• One specific database flow toward an internal server
• A protected management path from an administrative network
• Denial of unrelated access toward internal user and management systems

10. Scenario comparisons

Employees must authenticate before wired or wireless network access

Use 802.1X at the network edge, commonly with RADIUS as the centralized authentication service. The endpoint is the supplicant; the switch or access point is the authenticator.

Help-desk staff may view interfaces and reset access ports, but not change routing

Use centralized administrative AAA with TACACS+ and authorization that limits the allowed commands. Accounting can record the activity.

A BYOD device must be patched and encrypted before receiving the normal employee role

This is broader than simple identity verification. NAC posture policy fits because device condition affects the assigned access level. 802.1X may participate in the admission process, but the posture decision is the broader NAC function.

A user-facing switchport learns hundreds of MAC addresses

Investigate the reason, then use port security when the requirement is to limit Layer 2 MAC learning or define a violation action on that access port.

An application needs to look up a user's group memberships

Use LDAP or another directory interface appropriate to the environment. The clue is directory information, not network admission.

A web application accepts an assertion from a central identity provider

SAML fits the federation clue. The relying application consumes the assertion and applies its authorization policy.

Guests should reach the internet but never management addresses

Use segmentation plus ACL/firewall policy between the guest, internal, and management zones. A guest SSID or VLAN name alone does not enforce the restriction.

Users may browse normal sites but gambling categories must be blocked

Use URL filtering. An ACL that blocks one IP address does not express the requested web-category policy well.

11. Common exam traps

• Using authorization to describe login verification. Authentication verifies identity; authorization decides permissions.
• Treating accounting as billing only. Accounting can record network sessions and administrator activity.
• Choosing TACACS+ for ordinary endpoint network admission when the clue points to RADIUS and 802.1X.
• Choosing RADIUS only because "AAA" appears, even when the scenario is command authorization on routers and switches.
• Treating LDAP as a replacement word for every identity service.
• Calling SAML a switchport authentication protocol.
• Confusing the 802.1X authenticator with the authentication server. The switch or AP controls the edge; the server evaluates the identity.
• Choosing port security when the question requires user identity.
• Treating MAC filtering as strong authentication.
• Assuming NAC and 802.1X are identical. 802.1X is an edge admission mechanism; NAC can incorporate identity, posture, roles, remediation, and broader policy.
• Using a VLAN name as proof that segmentation is enforced.
• Choosing URL filtering to block a transport port.
• Choosing an ACL when the question requires inspection of a web category or file content.
• Treating a screened subnet as trusted simply because it has its own zone.
• Granting broad access after successful authentication instead of applying least privilege.

12. Rapid review grid

13. Official references

• CompTIA Network+ certification page
• IEEE 802.1X port-based network access control
• RFC 2865: Remote Authentication Dial In User Service
• RFC 8907: The TACACS+ Protocol
• OASIS Security Assertion Markup Language 2.0
• NIST SP 800-207: Zero Trust Architecture