Network Access Control (NAC)
Admission control that authenticates devices and checks their security posture before granting network access, typically via 802.1X, shunting failures to a quarantine VLAN.
Network Access Control decides whether a device may join the network at all, checking identity and security posture before a port or wireless association carries any traffic. The usual machinery is 802.1X: the connecting device (supplicant) presents credentials to the switch or access point (authenticator), which relays them to an authentication server, typically RADIUS. Posture checks then verify whatever policy demands: patch level, antivirus state, disk encryption, whether the device is corporate-managed at all.
The design choice a scenario is likely to turn on is agent versus agentless. An installed agent gives deep, continuous posture detail but cannot cover guests, personal phones, printers, or IoT gear; agentless assessment scans or profiles those unmanaged devices at the cost of depth. Failure is not a flat rejection: non-compliant devices land in a quarantine or remediation VLAN with just enough access to fetch patches, and guests get an internet-only segment. NAC authenticates the device and its health, complementing multi-factor authentication, which authenticates the user.
Exam relevance: if a scenario checks a laptop’s patch level before letting it join, or shunts an unhealthy device into a remediation VLAN, the answer is NAC; 802.1X is the port-based mechanism beneath it. Contrast MFA, which proves who the user is; NAC decides whether the device itself is fit to connect.