Home » Cisco » 300-208 » Which interface-level command is needed to turn on dot1x authentication?
Which interface-level command is needed to turn on dot1x authentication?
A. authentication pae authenticator
B. aaa server radius dynamic-author
C. authentication host-mode single-host
D. dot1x system-auth-control
Correct Answer: C
Explanation/Reference:
a – global command
b- wrong spelling should be (config-if)#dot1x pae authenticator c- Correct ANSWER d – global command
Global command:
In order to enable 802.1x functionality, enter this command:
Switch(config)# dot1x system-auth-control
Answer should be Dofl1x pae authenticator and its used for enabled the authentication in interface level other hand authentication host-mode single-host used to allow single host on authentication enabled interface.
Actually I will go with A. I have seen other questions where there’s a typo in the answers but still they are marked as correct. So without thinking too much I would select A.
C is the right answer.
A – Incorrect command
B – Not certainly
D – Not a Interface level command.
Correct Answer:A
switch(config-if)# dot1x pae authenticator
Enables 802.1X authentication on the port with default parameters.
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/31sg/configuration/guide/conf/dot1x.html
https://i.imgur.com/iJ2Epdk.png
If the question is checking the test taker if they know the correct syntax of the commands, then A would be wrong.
The only correct dot1.x interface command is C.
If the question is checking the test taker if they know the correct syntax of the commands, then A would be wrong.
The only correct dot1.x interface command is C.
example:
Switch(config-if)# [no] authentication host-mode{single-host | multi-host |multi-domain} | multi-auth}
Switch(config-if)# [no] dot1x host-mode {single-host | multi-host | multi-domain}
The keywords allow the following:
• single-host—Single-host (client) on an IEEE 802.1X-authorized port.
If the question is checking the test taker if they know the correct syntax of the commands, then D would be wrong.
The only correct dot1.x interface command is C.
example:
Switch(config-if)# [no] authentication host-mode{single-host | multi-host |multi-domain} | multi-auth}
Switch(config-if)# [no] dot1x host-mode {single-host | multi-host | multi-domain}
The keywords allow the following:
• single-host—Single-host (client) on an IEEE 802.1X-authorized port.
Actually at interface level it should be
(Config-if)# : dot1x pae authenticator , this is the command you input at the interface
“authentication pae authenticator” is the wrong syntax. Should be “dot1x pae authenticator” instead.
By exclusion “dot1x system-auth-control” is the best fit but it isn’t a interface level command.
“authentication host-mode single-host” is indeed a interface level command but not needed to enable dot1x authentication.
It is one of those ridiculos ambiguous questions that serves no purpose besides amusing cisco people…
At the Interface level – I believe it was confirmed as :
A. authentication pae authenticator (((( Based on reading – I find this to be the closest Match )))
B. aaa server radius dynamic-author
C. authentication host-mode single-host (((( Many people point to this as the correct answer – THis is not enabling 8021x )))
D. dot1x system-auth-control ((( (This command is a GLobal Command, not an Interface Level COmmand )))
Shakiem,
you are right If the question was global command to turn on dot1x authentication but in here they are looking for Interface level command.
looks like correct answer is D
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_8021x/configuration/xe-3se/3850/sec-user-8021x-xe-3se-3850-book/config-ieee-802x-pba.html
How to Configure IEEE 802.1X Port-Based Authentication
Enabling IEEE 802.1X Authentication and Authorization
SUMMARY STEPS
1. enable
2. configure terminal
3. aaa new-model
4. aaa authentication dot1x {default | listname} method1 [method2…]
5. dot1x system-auth-control