Section 21.202 Network Access Control (NAC)

Question 1

Network Access Control (NAC)

Answer 1

Scans devices for theri security status before granting network access, safeguarding against both known and unknown devices

■ Can be applied to devices within the internal network or those connecting remotely via VPN

■ NAC can be implemented as a hardware or software solution

Question 2

NAC Process

Answer 2

■ When a device attempts to connect, it is placed in a virtual holding area for scanning

■ Scanning checks various factors, including antivirus definitions, security patching, and potential security threats

■ If a device passes inspection, it is allowed network access

■ If a device fails inspection, it is placed in a digital quarantine area for remediation

Question 3

NAC Agent Types (Solution)

Persistent Agents

Answer 3

Installed on devices in a corporate environment where the organisation
owns and controls device software

Question 4

NAC Agent Types (Solution)

Non-Persistent Agents

Answer 4

Common in environments with personal devices (e.g college campuses) users connect, access a web-based captive portal, download an agent for scanning, and delete itself after inspection

Question 5

IEEE Standard 802.1x Standard

Answer 5

■ Port-based Network Access Control mechanism based on the IEEE 802.1x
standard

■ Modern NAC solutions build on 802.1x, enhancing features and capabilities

Question 6

Rule-Based Access Control

Time-Based Factors

In addition to health policy, NAC can use rule-based methods for access control

Answer 6

Define access periods based on time schedules; may block access
during non-working hours

Question 7

Rule-Based Access Control

Location-Based Factors

Answer 7

Evaluate the endpoint’s location using geolocation data to detect
unusual login locations

Question 8

Rule-Based Access Control

Role-Based Factors

Answer 8

Reevaluate device authorisation based on its role (adaptive NAC)

Question 9

Rule-Based Access Control

Rule-Based Factors

Answer 9

Implement complex admission policies with logical statements to
determine access based on conditions