A security administrator wants to profile endpoints and gain visibility into attempted authentications. Which 802.1x mode allows these actions?

In 802.1X Monitor Mode, the switch listens for EAP messages and forwards them to the authentication server, but it does not enforce authentication or block network access. This allows administrators to observe and log authentication attempts and endpoint characteristics for profiling purposes without disrupting network services. It is a non-disruptive way to prepare for full 802.1X deployment.

"High-Security mode" is not a standard 802.1X operational mode; it implies strict enforcement which is not aligned with monitoring.

"Low-impact mode" is not a standard 802.1X operational mode; while it sounds less restrictive, it doesn't specifically describe the profiling and visibility function.

Closed mode restricts all network access until successful 802.1X authentication occurs, which prevents profiling without enforcement.