AND-802 Exam Guide: Build Practical 802.1X and Network Access Control Knowledge
The supplied research does not identify AND-802’s issuing organization, exam blueprint, delivery format, prerequisites, or scoring rules. It does, however, document the 802.1X, RADIUS, MAC authentication, captive portal, certificate, and VLAN concepts that form a coherent preparation scope for a candidate working with network access control. Use this guide to decide whether your current knowledge is strong enough to schedule, or whether you should first build and test a structured lab-based study plan.
What can be confirmed about AND-802?
The available research confirms the technical subject area but not the administrative specification of AND-802. No official source supplied here states the exam’s owner, current status, number of questions, time limit, passing score, price, languages, delivery method, prerequisites, or retirement date. Treat any website or discussion that supplies those details as unverified until it can be checked against the issuing organization’s current page.
The evidence is centered on port-based network access control, especially IEEE 802.1X and related authentication choices. Junos documentation describes 802.1X, MAC RADIUS, and captive portal authentication, while Juniper Mist Access Assurance documentation discusses EAP-TLS, EAP-TTLS/PAP, MAB, MPSK, certificate-based authentication, and credential-based authentication. Those sources provide a sensible technical study boundary, but they do not constitute an AND-802 exam blueprint.
This distinction matters when deciding whether to book the exam. You can prepare for the documented technology, but you should not infer that every documented feature is tested or that the exam contains a particular proportion of questions. Confirm the official candidate guide, registration page, and current blueprint before making a payment or fixing a test date.
Who should use this preparation plan?
This plan is most suitable for network administrators, access-control engineers, wireless engineers, and security practitioners who need to explain or troubleshoot authenticated access to wired or wireless networks. It is also useful for candidates who already understand Ethernet switching and want to connect endpoint identity, authentication servers, and access policy into one operating model.
The official Junos material defines three basic 802.1X components: the supplicant, the authenticator port access entity, and the authentication server. A candidate should be able to identify these roles in a diagram, describe their traffic flow, and explain what changes when the endpoint is not 802.1X-enabled. The Mist material similarly describes the client, authenticator, and RADIUS server relationship for network access control.
Candidates with no networking foundation should not begin by memorizing authentication names. First learn Ethernet ports, VLAN assignment, DHCP timing, wireless access points, RADIUS, certificates, and basic packet-flow reasoning. Candidates with production experience should instead focus on edge cases: unsupported devices, authentication fallback, certificate provisioning, failed credentials, and the security consequences of password-based access.
Use your job context to set the emphasis
If your work is primarily wired switching, prioritize the interface state, EAPoL exchange, DHCP ordering, MAC RADIUS behavior, VLAN outcomes, and device exceptions. If your work is primarily wireless, add the access-point role, certificate deployment, identity-provider dependencies, and the risks of password-based 802.1X authentication. If you support both, study the shared protocol model first and then compare implementation differences.
This is a preparation recommendation, not an official AND-802 requirement. The supplied sources do not state an experience threshold or prerequisite. Keep a record of the assumptions you make about the exam scope and revisit them when you locate the issuing organization’s authoritative candidate documentation.
Which technical skills should you measure?
Measure your ability to reason through an access request, not merely to expand acronyms. You should be able to trace a responsive endpoint through EAPoL and RADIUS, distinguish a nonresponsive endpoint from one with rejected credentials, select a suitable authentication method for a device type, and predict when DHCP or ordinary data traffic is allowed. These are practical capabilities supported by the supplied technical documentation.
The research supports the following study domains: 802.1X architecture and traffic control; EAP and EAPoL; RADIUS communication; MAC RADIUS or MAB; captive portal authentication; certificate-based and credential-based methods; authentication fallback; static MAC bypass; server-reject VLAN behavior; and VLAN encapsulation concepts such as 802.1Q and 802.1ad QinQ. Do not call these official AND-802 domains unless the exam owner publishes that mapping.
Create a self-assessment with three ratings for each topic: explain, configure, and troubleshoot. For example, you may be able to explain that 802.1X is port-based access control but still be unable to identify why a client receives no DHCP response. The gap between conceptual recognition and diagnostic action is where lab work produces the greatest benefit.
Architecture and protocol flow
A strong candidate can identify the supplicant as the endpoint requesting network access, the authenticator as the device controlling the port, and the authentication server as the system validating credentials. In Junos documentation, EAPoL carries communication between the end device and the device, while RADIUS carries communication between the device and the authentication server. Draw this path until you can explain each arrow without notes.
During 802.1X authentication, only 802.1X and control traffic can transit the network; ordinary traffic such as DHCP and HTTP is blocked at the data-link layer until authentication succeeds. This makes DHCP failure an important symptom, but not a sufficient diagnosis. Check whether authentication completed before assuming that the DHCP service is broken.
Authentication method selection
Compare methods by endpoint capability, deployment process, user experience, and security exposure. 802.1X suits endpoints with authentication software. MAC RADIUS or MAB is relevant to devices that do not support 802.1X, such as many printers and IP phones. Captive portal authentication permits an endpoint to obtain an IP address so it can be redirected to a login page. These behaviors are documented in the Junos source.
Mist documentation identifies EAP-TLS as certificate-based and EAP-TTLS/PAP as credential-based. It also lists MAB and MPSK as non-802.1X methods. Your study notes should show not only what each method is called, but what identity material it uses, where validation occurs, and what operational dependency could fail.
Security and deployment judgment
Certificate-based authentication uses a public key infrastructure and requires client-device provisioning; the documentation notes that mobile-device management is typically used for that provisioning. Password-based authentication requires an identity provider, and Juniper warns about person-in-the-middle risk, particularly in wireless and BYOD scenarios. Treat these as design judgments to understand, not as permission to apply one method universally.
A useful exercise is to write a short recommendation for three endpoint groups: managed employee devices, unmanaged personal devices, and non-802.1X equipment. State the proposed method, identity source, exception path, and containment action for failed authentication. Then challenge each recommendation by asking what happens if certificates expire, the identity provider is unavailable, or the device has no supplicant.
How should you study authentication behavior?
Study in dependency order: first learn the three-party architecture, then follow a successful 802.1X exchange, then add RADIUS and DHCP timing, and only after that study MAB, captive portal, fallback, and bypass. This sequence prevents a common error—memorizing individual features without understanding the port state that determines whether a later protocol can run.
Begin with the Junos Access Control Authentication Methods page. Extract a one-page flow diagram containing the supplicant, authenticator, authentication server, EAPoL, RADIUS, DHCP, and the permitted traffic state. Next, read the Mist authentication methods page and build a comparison of EAP-TLS, EAP-TTLS/PAP, MAB, MPSK, certificate-based authentication, and credential-based authentication.
Do not copy configuration syntax into notes without explaining its effect. For every setting or method, answer four questions: Which endpoint does it serve? What identity is presented? Which system validates it? What access does the endpoint receive before and after the decision? If you cannot answer the fourth question, return to the protocol flow rather than adding more memorization cards.
A practical lab sequence
Use an isolated lab or approved simulation, not a production switch, to test the sequence. Start with one 802.1X-capable client, one authenticator, and a RADIUS service. Observe the client before authentication, during authentication, and after acceptance. Record whether EAPoL, RADIUS, DHCP, and ordinary data traffic are visible at each stage. The goal is to connect symptoms to states.
Add a non-802.1X endpoint and model MAC RADIUS or MAB. The Junos documentation states that the device can send the end device’s MAC address to the authentication server when a nonresponsive endpoint is detected. Compare that process with a responsive endpoint that supplies EAP credentials. This contrast is more useful than learning MAB as an isolated abbreviation.
Then test a failed credential path and a server-reject VLAN concept. The Junos source describes a server-reject VLAN as a way to provide limited LAN access to responsive 802.1X-enabled endpoints that supplied incorrect credentials. Record the intended remediation access and the services that should remain unavailable. Do not assume that every implementation handles VLANs identically.
Turn documentation into recall tools
Make cards from decisions and failure symptoms. Examples include: “Why might DHCP be unavailable before 802.1X succeeds?”, “Which method helps a printer that lacks 802.1X support?”, “What does mac-radius-restrict change?”, and “Why can a captive portal require an IP address before authentication?” Answer each in your own words and attach the relevant official URL.
Use diagrams for sequences and tables for contrasts. A sequence diagram should show who initiates the exchange and when access changes. A contrast table should separate EAP-TLS from EAP-TTLS/PAP, 802.1X from MAC RADIUS, and captive portal from pre-IP authentication. Keep implementation-specific commands in a separate appendix so they do not obscure the protocol concepts.
What fallback and exception rules deserve special attention?
Fallback and exceptions are high-value study areas because they combine policy intent with ordering behavior. Junos documentation states that 802.1X, MAC RADIUS, and captive portal can be configured on one interface to enable fallback, and that the authentication order can be overridden. It also documents restrictions and special cases that should be learned as conditions, not as universal design advice.
Work through a decision tree. First ask whether the endpoint responds to 802.1X. If it does, the device attempts 802.1X when configured. If it does not, MAC RADIUS can authenticate the endpoint’s MAC address. If authentication fails, determine whether the configured fallback, server-reject VLAN, captive portal, or bypass policy applies. Finally, identify what access is intentionally limited rather than assuming every failure should result in unrestricted connectivity.
One documented constraint is especially easy to miss: MAC RADIUS and captive portal cannot both be configured on an interface without also configuring 802.1X. Another states that configuring mac-radius-restrict causes the device to drop all 802.1X packets. These are configuration interactions to verify in the relevant platform documentation, not rules to generalize to every vendor.
Separate nonresponsive devices from rejected credentials
A nonresponsive endpoint is not 802.1X-enabled; it is not the same as an endpoint that tried 802.1X with incorrect credentials. The first case may lead to MAC-based authentication. The second may lead to a server-reject VLAN or another failure policy. Put both cases into your notes with distinct packet-flow diagrams and expected access outcomes.
A common mistake is to describe every failed login as a MAB event. That loses the difference between endpoint capability, identity validation, and policy response. In a troubleshooting exercise, identify which message or timeout demonstrates nonresponse, which server result demonstrates rejection, and which configuration determines the next method.
Understand bypass as a controlled exception
Static MAC bypass is intended for an explicit exception list, such as a non-802.1X device that must access the LAN. Treat it as an inventory and governance problem as well as a configuration feature. For each bypassed device, record its owner, location, purpose, permitted network, review date, and replacement plan. This operational discipline is a recommendation, not a stated AND-802 requirement.
Do not present bypass as equivalent to strong user or device authentication. It relies on the identity represented by the MAC address and should therefore be constrained by segmentation and monitoring appropriate to the environment. The supplied Junos source confirms that bypass can allow non-802.1X-enabled devices access to the LAN; it does not prescribe your organization’s exception policy.
How do VLAN topics fit into preparation?
Study VLANs as the access result and transport context of authentication, not as a detached switching chapter. Authentication may determine which network segment an endpoint can use, while VLAN tagging determines how traffic is carried between network devices. The supplied Fortinet community source specifically addresses the difference between IEEE 802.1Q and IEEE 802.1ad QinQ, so include those terms only as documented VLAN concepts rather than assuming they are AND-802 objectives.
Build a small comparison with these columns: tag purpose, location in the frame, number of VLAN identification layers, and likely service-provider or campus use. Verify the technical details directly in the Fortinet source before finalizing the table. Because no AND-802 blueprint is supplied, keep this topic proportionate to your background and to any official exam outline you later obtain.
For access-control troubleshooting, always ask whether the problem is authentication, authorization, VLAN assignment, tagging, DHCP reachability, or endpoint policy. A successful RADIUS response does not by itself prove that the endpoint has usable connectivity. Conversely, a DHCP address obtained through a captive portal flow does not prove that the endpoint has passed 802.1X.
What mistakes should you avoid?
The most damaging preparation mistakes are treating authentication methods as interchangeable, confusing endpoint nonresponse with credential rejection, ignoring traffic restrictions before authentication, and relying on unsupported exam claims. Correct these by drawing flows, testing one variable at a time, and separating verified source facts from your own implementation assumptions.
Avoid memorizing a default authentication order as though it were universal. The Junos documentation describes a default order and also explains that authentication order can be overridden. Your notes should therefore say “documented Junos behavior” rather than turning that behavior into a general networking rule.
Avoid assuming that a method’s presence means it is appropriate for every device. EAP-TLS has certificate-provisioning requirements. Password-based 802.1X has security and MFA limitations described by Juniper Mist. MAB addresses devices that cannot perform 802.1X but introduces a different identity model. Good exam preparation requires choosing among trade-offs, not naming every option as equally strong.
Do not use dumps, leaked questions, or memorization claims as a substitute for understanding. They cannot establish the current exam scope, may contain inaccurate or unauthorized material, and do not teach you how to diagnose a blocked DHCP exchange or a failed certificate. Use official documentation and original scenario questions that test reasoning.
A four-stage roadmap for the final study period
A staged plan is more reliable than repeatedly rereading the same page. Start with architecture, move to method selection, then practice failure isolation, and finish by checking administrative facts from the official exam owner. The number of days and hours should depend on your baseline; the roadmap below is a sequence of tasks, not a claim about exam duration or required preparation time.
Stage one: establish the model. Draw the supplicant, authenticator, and authentication server. Explain EAPoL and RADIUS, state what traffic is blocked during 802.1X, and explain why DHCP timing matters. Read the Junos authentication overview and the Mist 802.1X sections. Finish only when you can narrate a successful authentication without looking at notes.
Stage two: compare methods. Create a decision matrix for 802.1X, EAP-TLS, EAP-TTLS/PAP, MAC RADIUS or MAB, captive portal, MPSK, and static MAC bypass. For each, record endpoint requirements, identity material, validation path, access timing, and a likely operational limitation. Mark which entries are directly supported by the supplied sources and which are your own lab assumptions.
Stage three: troubleshoot scenarios. Work through an endpoint that does not respond, a client with incorrect credentials, an unavailable RADIUS server, an expired or missing certificate, a failed VLAN assignment, and a captive portal redirection problem. For each scenario, identify the earliest observable failure, the next check, and the least-privilege recovery path. Do not jump directly to changing authentication methods.
Stage four: verify readiness and logistics. Recheck the issuing organization’s official AND-802 page for the current blueprint, registration conditions, prerequisites, delivery information, score policy, and allowed resources. The supplied snapshot does not verify those items. If no authoritative page can be located, postpone any scheduling decision rather than treating catalogue text or third-party summaries as official.
Use a readiness gate before scheduling
Schedule only after you can explain the protocol flows, choose an authentication method for several endpoint types, distinguish authentication failure from network transport failure, and troubleshoot without relying on a memorized answer. Also confirm the exam’s official scope and current administrative rules. This gate is a practical recommendation; it is not an AND-802 passing standard.
If your knowledge is uneven, schedule study milestones instead of the exam. For example, require yourself to complete the architecture diagram, method matrix, and scenario log before booking. Review every incorrect answer by locating the underlying concept in documentation or your lab notes. A score from an unofficial practice source should guide study priorities, not be treated as a prediction of the real result.
Prepare a last-review sheet
Keep the final sheet compact: component roles, EAPoL versus RADIUS, pre-authentication traffic limits, DHCP timing, responsive versus nonresponsive endpoints, MAB or MAC RADIUS, captive portal behavior, EAP-TLS, EAP-TTLS/PAP, fallback ordering, server-reject VLAN, and the mac-radius-restrict interaction. Add a source link beside each item so that a disputed detail can be checked quickly.
Leave out unverified numbers, dates, prices, question counts, and scoring rules. Those details become liabilities when they are copied from an old catalogue entry. Replace them with a reminder to consult the current official registration and candidate pages before the appointment.
What should you do next?
Your next action is to establish the missing exam facts, then test the documented technical scope. Locate the official AND-802 candidate page, compare its objectives with the 802.1X and access-control topics in this guide, and mark any objective that is absent from the supplied research. After that, build or access an authorized lab and begin with the three-party authentication model.
Use the Junos source for port-based access control, EAPoL, RADIUS, DHCP timing, authentication methods, fallback, bypass, and server-reject behavior. Use the Mist source for certificate-based and credential-based authentication, EAP-TLS, EAP-TTLS/PAP, MAB, MPSK, and the documented security considerations. Use the Fortinet VLAN source only for its 802.1Q and 802.1ad comparison. The FortiNAC and Microsoft Teams links are available official-domain references, but the supplied verified facts do not establish additional AND-802 requirements from them.
Once your lab notes show that you can predict access behavior and isolate failures, revisit the official exam information and make the scheduling decision. That process gives you a defensible preparation basis without pretending that the available snapshot contains a blueprint, score policy, or test-delivery specification.
Conclusion
AND-802 preparation should be based on verified objectives and demonstrated network-access reasoning, not on assumed exam statistics or answer memorization. The supplied evidence supports focused study of 802.1X architecture, EAPoL and RADIUS, authentication alternatives, certificate and credential choices, fallback behavior, VLAN context, and failure diagnosis. Confirm the exam owner’s current requirements before scheduling, then use a lab, decision matrix, and scenario log to turn those topics into operational skill.
Related exams
- AND-801 exam — Android Application Development v8
- AND-803 exam — Android Applications UI/UX Design and Monetization Techniques
