Bob, a network administrator at BigUniversity, realized that some students are connecting their notebooks in the wired network to have Internet access. In the university campus, there are many…

Disabling unused ports only prevents access on those specific ports and does not scale - professors or visitors may vacate a port, leaving it enabled and exploitable without authentication enforcement.

Separating students into a VLAN assumes students are already identified and admitted to the network - it does not prevent unauthorized devices from initially connecting to the wired infrastructure.

IEEE 802.1X enforces authentication at the switch port level before granting Layer 2 network access, using an EAP-based exchange between the supplicant (client), authenticator (switch), and authentication server (RADIUS). Any device plugging into a port is held in an unauthorized state until valid credentials are provided. This directly prevents unauthenticated students from accessing the network regardless of which physical port they use.

Asking students to use wireless is a policy request with no technical enforcement mechanism and does not prevent them from physically plugging into Ethernet ports.