CompTIA Security+ (SY0-701) — Practice Questions and Mock Exam

The confusion here is real, and it comes from the switch wearing two hats. In the 802.1X vocabulary there are three roles: the workstation is the supplicant, the access switch is the authenticator, and the central server is the authentication server. In the RADIUS vocabulary there are only two, and the network access server, which here is the switch, operates as a client of RADIUS. It passes user information to the designated servers and then acts on the response returned, which in practice means opening the port, assigning a VLAN, or leaving the port unauthorized.

So the same box is a server from the workstation's point of view and a client from the point of view of the authentication infrastructure, and the question asks specifically for the RADIUS terminology.

The distractors map onto the other roles. The authentication server is the one that validates credentials and returns configuration attributes, which the switch never does. The supplicant is the workstation presenting credentials. The certificate authority signs and vouches for certificates ahead of time and is not a participant in the live exchange at all, even when certificate-based authentication is in use.

Exam tip: when a question names a vocabulary explicitly, translate the device into that vocabulary before answering. The same box has different names in 802.1X and in RADIUS, and the exam tests exactly that seam.

David Bianco's Pyramid of Pain (2013) ranks threat indicators by how much difficulty changing them causes attackers. From bottom to top: Hash Values → IP Addresses → Domain Names → Network/Host Artifacts → Tools → TTPs. Hash values sit at the base because changing even a single byte in a malware binary produces a completely different hash. Attackers can recompile, repack, or add junk data to instantly evade hash-based detection, making hash IOCs extremely short-lived. In contrast, TTPs at the apex represent fundamental attacker behaviors requiring significant retooling to change. Effective threat intelligence focuses detection on higher pyramid levels for more durable defenses. While hash-based indicators are useful for immediate blocking, they provide minimal long-term defensive value. Ref: Bianco, D. (2013) The Pyramid of Pain; MITRE ATT&CK framework.

User awareness training exists to change what a person does in the seconds after a suspicious message arrives, so the topic has to be one where the user is the control. Phishing identification and reporting is exactly that: criminals send messages designed to get someone to open a harmful link or attachment, or to hand over personal information, and no technical filter catches all of them. Teaching people the recognizable signs, such as urgency, a request for credentials or payment details, and a sender address that is almost but not quite right, and teaching them where to report it, gives the security team early warning across the whole organization.

The other three topics all belong in a security program, but none of them is about recognizing a social engineering message. Password complexity is a credential-hygiene rule, and it is increasingly enforced by policy and password managers rather than by user vigilance. A clean desk policy addresses physical information exposure in the office. Badge procedures address physical access and tailgating. Someone trained only in those three would still click the link.

Exam tip: match the control to the attack vector named in the stem. When the stem says social engineering and asks what users should be taught, reporting is the half candidates forget, because recognition without a reporting path leaves the organization blind.

802.1X defines three roles in port-based network access control: The supplicant is the client device (laptop, phone, IoT device) running software that communicates authentication credentials via EAP (Extensible Authentication Protocol). Common supplicant software includes the built-in 802.1X clients in Windows, macOS, and Linux. The authenticator is the network device (switch or wireless access point) that controls physical or logical access to the network. Before authentication succeeds, the port only allows EAP traffic. After successful authentication, the port opens for normal traffic. The authentication server (typically a RADIUS server like FreeRADIUS, Cisco ISE, or Microsoft NPS) receives the credentials from the authenticator and verifies them against a directory (Active Directory, LDAP). It returns accept/reject to the authenticator. The authenticator acts as a proxy — it does not evaluate credentials itself but forwards them to the authentication server. Exam tip: 802.1X roles: supplicant (client requesting access), authenticator (switch/AP controlling the port), authentication server (RADIUS verifying credentials).