An engineer configured 802.1X authentication on a switch port but cannot authenticate. Which action must the engineer take to validate if the user credentials are correct?

When 802.1X authentication fails due to incorrect credentials, the authentication server (e.g., RADIUS server) is the authoritative source for validating these credentials. Its logs will explicitly show authentication attempts, whether they succeeded or were rejected, and often provide the reason for rejection, such as invalid username or password, which directly helps confirm if the user's credentials are correct.

The policy enforcement point (the switch) only forwards authentication requests; it does not validate credentials itself or log the actual credentials used, only the authentication outcome reported by the server.

While the supplicant logs might show the username entered, they generally do not display the password for security reasons. Checking supplicant logs alone won't validate credentials against the server.

Debug logs on the authenticator (switch) can provide details about the 802.1X handshake but typically do not expose the user's password in plain text or definitively confirm credential correctness in the same way the authentication server logs do.