A company determines a need for additional protection from rogue devices plugging into physical ports around the building. Which of the following provides the highest degree of protection from…

Intrusion Prevention Systems inspect in-flight traffic and block malicious activity but do not authenticate devices at the port level, meaning a rogue device can still connect and begin communicating before any IPS policy applies.

MAC filtering restricts access based on hardware addresses but is easily defeated by cloning a known-good MAC address, making it a significantly weaker control than 802.1x credential-based authentication.

Flood guards limit unknown unicast or multicast frame rates to protect the CAM table from overflow attacks and serve no role in authenticating or authorizing devices that connect to physical ports.

802.1x places a physical port in an unauthorized state immediately upon device connection, blocking all traffic except EAP authentication frames until the device successfully authenticates against a RADIUS server. Because authentication is required at the port level before network access is granted, it cannot be bypassed by simply plugging in a device, making it the highest-assurance option for preventing unauthorized wired access.