Your Layer 2 network uses 802.1X to authenticate user devices connecting to the network. You are asked to include a new Layer 2 interface connection…

The single-secure supplicant mode is specifically designed to enhance port security by allowing only one end device to authenticate on an 802.1X-enabled port. After the first device successfully authenticates, the switch monitors the port for any other MAC addresses. If a new MAC address is detected, which would occur if a user connected a rogue switch, the port is error-disabled (shut down). This provides the most robust security to meet the requirement of preventing unauthorized devices from piggybacking on the connection.

B. multiple supplicant mode: This mode explicitly allows multiple devices to authenticate on the same port, which is the opposite of the stated security requirement.

C. single supplicant mode: This mode allows only the first device to authenticate, but it does not shut down the port if other devices attempt to connect; it simply denies them access. This is less secure than single-secure.

D. MAC-RADIUS: This is a fallback authentication method for non-802.1X capable devices, not a supplicant mode that controls the number of devices allowed on a port.

1. Juniper Networks TechLibrary, "Understanding 802.1X Multiple Supplicant, Single Supplicant, and Single-Secure Supplicant Modes": This document explicitly defines the behavior of single-secure supplicant mode. It states, "In single-secure supplicant mode, only one supplicant is allowed on the authenticator port... If another supplicant connects to the port and attempts to send traffic, the port is shut down." This directly supports the choice of option A for preventing rogue switch connections.

2. Juniper Networks TechLibrary, "Configuring 802.1X Interface Settings (CLI Procedure)": This guide shows the configuration command set protocols dot1x authenticator interface supplicant single-secure, confirming it as a distinct and configurable mode designed for high-security scenarios. It differentiates this from supplicant single and supplicant multiple.

3. Juniper Day One Guide: "Deploying 802.1X", Page 21, "Supplicant Modes": This guide explains, "Single-secure supplicant mode: This mode is similar to single supplicant mode, but provides a higher level of port security... If another supplicant connects to the port and attempts to send traffic, the port is shut down." This reinforces that single-secure is the correct choice for the highest level of security against unauthorized additional devices.