AND-802 Exam Guide: Build Practical 802.1X and Network Access Control Skills
The supplied material identifies AND-802 with a technical focus on 802.1X, network access control, authentication methods, RADIUS, and related VLAN concepts, but it does not include an official exam blueprint or delivery specification. This guide is therefore designed for network and security practitioners who need to decide whether their preparation is strong enough for an access-control assessment and which skills to practise first. It separates documented technology behavior from study recommendations so you can prepare without relying on unsupported exam claims or memorized question sets.
What does AND-802 appear to assess?
The available evidence supports preparing for AND-802 as an access-control and authentication exam centered on 802.1X behavior, authentication roles, RADIUS exchanges, fallback methods, and deployment decisions across wired and wireless networks. No official AND-802 objectives, domain weights, pass score, question count, duration, language list, or delivery method were supplied, so those details should be confirmed through the exam owner before scheduling.
The technical center of gravity
802.1X is an IEEE standard for port-based network access control. In the Junos model, the end device communicates with the authenticator using EAP over LAN, while the authenticator communicates with the RADIUS authentication server. During authentication, ordinary traffic is blocked and only 802.1X and control traffic can pass. These relationships are more useful to learn than isolated terminology. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
What is not verified
The supplied research does not establish whether AND-802 is current, retired, vendor-specific, associated with a particular testing provider, or governed by a published blueprint. It also does not verify prerequisites, registration steps, exam cost, scheduling windows, retake rules, or accommodations. Treat any third-party listing that supplies those details as a lead to investigate, not as confirmation.
Who should use this preparation plan?
This plan suits candidates who configure or troubleshoot switch access ports, wireless access, RADIUS-backed identity controls, endpoint onboarding, or network segmentation. It is especially relevant to practitioners who must choose between certificate-based 802.1X, credential-based authentication, MAC-based fallback, captive portal access, and controlled remediation for devices that cannot complete 802.1X.
Network administrators
Administrators should be able to explain what happens before an endpoint receives a DHCP address, identify the device acting as authenticator, and reason about the impact of an authentication failure. Junos documentation states that 802.1X and MAC RADIUS clients must authenticate before receiving an IP address, whereas captive portal clients receive an address so they can be redirected to a login page. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
Security and identity practitioners
Security-focused candidates should concentrate on identity assurance, certificate provisioning, RADIUS policy, trust relationships, and the risks of password-based access. Mist Access Assurance documentation describes EAP-TLS as certificate-based and EAP-TTLS/PAP as credential-based, and recommends avoiding password-based 802.1X for BYOD scenarios because of potential person-in-the-middle attack vectors. [https://www.juniper.net/documentation/us/en/software/mist/mist-access/topics/topic-map/access-assurance-authentication-methods.html]
Support and operations teams
Support candidates need a fault-isolation model rather than only configuration recall. They should distinguish an endpoint that is 802.1X-enabled but rejected for incorrect credentials from one that is not 802.1X-enabled at all. That distinction affects whether to investigate certificates or credentials, use MAC RADIUS, place the device in a bypass list, or provide a restricted remediation path.
Which skills should you measure while studying?
Because no official AND-802 domain list or weights was provided, use capability checks instead of invented percentage targets. Your study should show that you can describe the access-control sequence, select an authentication approach for a device profile, predict fallback behavior, identify incompatible configurations, and troubleshoot the boundary between endpoint, authenticator, and RADIUS server.
Explain the authentication architecture
A LAN 802.1X configuration contains a supplicant, an authenticator port access entity, and an authentication server. The supplicant requests network access, the authenticator controls the interface, and the authentication server validates the presented identity. Practise drawing the message path and labeling which connection uses EAPoL and which uses RADIUS. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
Select a method for the endpoint
802.1X is appropriate for an endpoint that can run a supplicant and present EAP credentials. MAC RADIUS is intended for devices such as printers and IP phones that do not support 802.1X. Captive portal is a different workflow because the device must obtain an IP address before redirection. The correct answer depends on endpoint capability and the desired trust level, not simply on whether a method is available. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
Reason about authentication assurance
Certificate-based authentication uses a public key infrastructure and a private-public key pair, and it can provide mutual authentication between server and client devices. Credential-based authentication relies on an identity provider. Mist documentation notes that certificate-based deployment typically requires client provisioning, often through mobile device management, while password-based 802.1X may be impractical where identity providers enforce MFA. [https://www.juniper.net/documentation/us/en/software/mist/mist-access/topics/topic-map/access-assurance-authentication-methods.html]
Predict policy and fallback outcomes
You should be able to predict what happens when a responsive endpoint supplies incorrect credentials, when a nonresponsive endpoint appears, and when one authentication method fails. Junos supports fallback among 802.1X, MAC RADIUS, and captive portal, and the authentication order can be overridden. It also allows a server-reject VLAN to provide limited access to a responsive endpoint rejected for incorrect credentials. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
How should you learn the 802.1X sequence?
Learn the sequence as a state change, not as a vocabulary list: an endpoint begins outside normal network access, the authenticator exchanges authentication traffic, the RADIUS server validates the identity, and the interface policy changes only after successful authentication. Then compare that sequence with MAC RADIUS and captive portal so you can explain why each method behaves differently.
Start with the three roles
Write a short explanation of the supplicant, authenticator, and authentication server without looking at your notes. Then add the protocol used on each leg. A responsive end device is 802.1X-enabled and supplies credentials using EAP; a nonresponsive end device is not 802.1X-enabled and may be handled through MAC RADIUS. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
Trace the traffic restriction
Explain why DHCP and HTTP do not behave like ordinary pre-authentication traffic on an 802.1X-controlled interface. Junos documentation states that, while 802.1X authentication is in process, only 802.1X and control traffic can transit the network; DHCP and HTTP are blocked at the data-link layer. This should lead you to check authentication state before blaming address assignment. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
Compare EAP choices
Create a comparison sheet for EAP MD5, EAP-TLS, EAP-TTLS, and PEAP using only attributes you can support: credential type, certificate involvement, tunnel or mutual-authentication considerations, and deployment implications. The Junos documentation identifies username and password for EAP MD5, and username plus client certificates for EAP-TLS, EAP-TTLS, and PEAP in the stated credential discussion. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
How do you choose certificate-based or credential-based access?
Choose certificate-based 802.1X when the organization can operate the required PKI, provision client devices, and manage certificate lifecycle. Consider credential-based authentication as a transitional or constrained option rather than an automatic default, especially for BYOD. The study goal is to justify the choice using deployment capability and attack exposure, not to declare one method universally correct.
Study EAP-TLS as an operational system
Do not stop at the phrase “certificate-based.” Map the certificate chain, client provisioning, server validation, identity mapping, revocation or expiration handling, and the effect of a missing client certificate. Mist documentation describes EAP-TLS as using TLS, X.509 certificates, and public key infrastructure, with client provisioning typically handled through mobile device management. [https://www.juniper.net/documentation/us/en/software/mist/mist-access/topics/topic-map/access-assurance-authentication-methods.html]
Treat passwords as a decision with risk
A password-based design requires an identity provider and may not fit smoothly with MFA-driven identity environments. Mist documentation identifies significant person-in-the-middle risk for password-based 802.1X, particularly on wireless networks, and advises avoiding it in BYOD networks. In your notes, record both the operational reason a team might use credentials and the security reason to migrate toward certificates. [https://www.juniper.net/documentation/us/en/software/mist/mist-access/topics/topic-map/access-assurance-authentication-methods.html]
Use scenario questions you write yourself
Create scenarios such as a managed laptop with a client certificate, an unmanaged visitor device, a printer without a supplicant, and a phone that must retain voice service during a rejection. For each, identify the authentication method, required infrastructure, likely failure point, and acceptable restricted-access behavior. This is a practical recommendation, not a claim about the format of AND-802 questions.
How do MAC RADIUS, bypass, and captive portal differ?
MAC RADIUS authenticates an endpoint by sending its MAC address to the RADIUS server when the device is not using 802.1X. Static MAC bypass uses an allow list for selected devices. Captive portal permits address acquisition so the endpoint can reach a login page. Study these as distinct control paths with different evidence and limitations, not as interchangeable names.
MAC RADIUS for non-supplicant devices
Junos describes MAC RADIUS as useful for devices that do not support 802.1X, including examples such as printers and IP phones. When a non-802.1X-enabled device is detected, the device transmits its MAC address to the authentication server. The weakness to understand is that the identifier is tied to the device address rather than a full supplicant exchange. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
Static MAC bypass as an exception
A bypass list is an exception mechanism for allowing selected non-802.1X devices onto the LAN. Practise stating what makes the exception safe enough for the environment: accurate inventory, narrow scope, monitoring, and a removal process when the device is replaced. The official material confirms the use case of allowing non-802.1X-enabled devices access; the operational controls here are preparation recommendations. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
Captive portal as a separate access flow
Captive portal does not behave like pre-address authentication. Junos states that captive portal clients can acquire an IP address and are redirected to a login page, while 802.1X and MAC RADIUS clients must be authenticated before receiving an address from DHCP. This distinction is a useful troubleshooting checkpoint when a client appears connected but cannot complete access. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
What fallback rules and configuration traps deserve attention?
The most important preparation trap is assuming that enabling several methods produces any desired combination. Junos permits 802.1X, MAC RADIUS, and captive portal fallback, but it also documents a specific restriction: MAC RADIUS and captive portal cannot both be configured on an interface unless 802.1X is also configured. Configuration order and restrictive options can change the result.
Understand the default and overridden order
By default, when 802.1X is configured on an interface, the device sends EAPoL requests and attempts 802.1X authentication. If that attempt fails in the documented fallback case, it can try MAC RADIUS. The authentication-order statement can override the default order for 802.1X and MAC RADIUS. Draw the decision tree before reviewing syntax. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
Know the mac-radius-restrict consequence
The mac-radius-restrict option is not merely a performance preference. Junos states that configuring it causes the device to drop all 802.1X packets, and describes it as useful when only nonresponsive supplicants are expected and no other 802.1X options, such as a guest VLAN, are needed. Treat this as a deliberate interface design choice. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
Check platform boundaries
Do not generalize a working access-port design to every interface type. Junos documentation states that 802.1X authentication cannot be configured on redundant trunk groups. Also test whether the desired fallback, guest, or server-reject behavior is supported on the actual platform and software version used in your environment. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
Separate authentication failure from policy failure
A successful identity exchange does not by itself prove that the endpoint received the intended access. During study, separate four questions: did the supplicant respond, did the authenticator reach RADIUS, did the server accept the identity, and did the resulting policy permit the expected VLAN or service? This habit prevents you from treating every connection problem as an EAP problem.
How should you practise wired and wireless access scenarios?
Use the same core 802.1X model across wired and wireless access points, then add the differences introduced by endpoint mobility, certificate deployment, and wireless threat exposure. Mist describes 802.1X as applying to devices connecting to a LAN or WLAN through a switch or access point and supports 802.1X and MAC Authentication Bypass for uniform wired and wireless access control. [https://www.juniper.net/documentation/us/en/software/mist/mist-access/topics/topic-map/access-assurance-authentication-methods.html]
Build a wired lab sequence
In a permitted lab, begin with one managed endpoint and verify the supplicant, authenticator, RADIUS reachability, server decision, and post-authentication network state. Add a non-802.1X device only after the first flow is understood. Record what changes when the endpoint is silent, rejected, accepted, or placed into a restricted policy. Do not use live production changes as a substitute for controlled practice.
Add wireless and BYOD reasoning
For wireless scenarios, focus on certificate trust, device provisioning, identity-provider interaction, and the risk of password-based authentication. Avoid assuming that a user who can complete ordinary MFA will automatically complete an 802.1X exchange; the network access method and endpoint supplicant still need compatible credentials and trust configuration. The security caution for BYOD is explicitly documented by Juniper Mist. [https://www.juniper.net/documentation/us/en/software/mist/mist-access/topics/topic-map/access-assurance-authentication-methods.html]
Use VLAN concepts carefully
Review VLAN tagging only to the depth required by the access-control scenario you can evidence. The supplied Fortinet material covers the distinction between IEEE 802.1Q and IEEE 802.1ad QinQ, so candidates working across vendor environments can use it to reinforce tag and encapsulation terminology. Do not infer that the presence of a VLAN reference establishes an AND-802 blueprint domain or weight. [https://community.fortinet.com/fortigate-3/technical-tip-understanding-the-difference-between-vlan-protocols-802-1q-and-802-1ad-qinq-144599]
What is a reliable troubleshooting workflow?
Troubleshoot from the endpoint outward: confirm supplicant capability and credentials, verify link or wireless association, inspect EAPoL behavior, check authenticator state, validate RADIUS communication and policy, and only then examine DHCP or downstream access. This order follows the documented dependency that 802.1X and MAC RADIUS authentication precede IP address assignment.
When no authentication starts
Check whether the endpoint is actually 802.1X-enabled, whether the supplicant is running, and whether the interface is configured to send the expected requests. A nonresponsive endpoint should not be diagnosed as a bad password. If the interface uses mac-radius-restrict, remember that the device drops 802.1X packets by design. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
When credentials are rejected
Confirm the EAP method, username format, certificate validity, trust chain, and RADIUS policy. If the endpoint is responsive but sends incorrect credentials, a server-reject VLAN may provide limited LAN access for remediation. Junos notes that voice traffic is dropped when an IP phone is authenticated using the server-reject VLAN, so do not assume restricted access preserves every service. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
When a non-supplicant cannot connect
Check MAC RADIUS configuration, the format used by the RADIUS server, the device inventory, and the resulting authorization policy. A printer or IP phone may be functioning normally while failing 802.1X simply because it lacks the protocol. The right response is to select and secure an appropriate non-802.1X path, not to repeatedly test user credentials. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
When the client has an address but no usable access
An IP address does not prove full authentication. Captive portal is specifically designed to allow address acquisition before redirecting the endpoint to a login page, whereas 802.1X and MAC RADIUS ordinarily authenticate before DHCP address assignment. Identify the active method and inspect the redirection or authorization state before changing DHCP settings. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
What study mistakes should you avoid?
The most damaging mistakes are learning method names without their sequence, treating MAC RADIUS as equivalent to certificate-based identity, ignoring configuration restrictions, and trusting unverified claims about the exam itself. Build explanations and decision trees from the documentation, then test whether you can apply them to endpoint, interface, and policy scenarios.
Do not memorise an invented blueprint
No AND-802 domain percentages appear in the supplied research. Do not assign study time using unsupported weights or describe a domain as carrying a particular percentage. Instead, prioritise the capabilities repeatedly supported by the evidence: 802.1X roles and flow, EAP and RADIUS relationships, endpoint method selection, fallback, and access-control troubleshooting.
Do not confuse authentication with authorization
Authentication establishes whether the endpoint or identity is accepted; authorization determines what access follows. A server-reject VLAN, guest access, a bypass list, or a post-authentication VLAN is a policy outcome, not a different proof that the original identity exchange succeeded. Use separate columns for identity evidence and resulting network permission in your notes.
Do not use dumps as a substitute for competence
Exam dumps and leaked questions are not a dependable preparation method and cannot guarantee a pass. They can also encourage memorisation of stale or misleading behavior. Study the official technical documentation, create your own scenario questions, and verify each answer against the cited source. Practise only in systems and environments where you are authorized to test.
Do not overgeneralize vendor syntax
The supplied sources include Junos, Mist, FortiNAC, Fortinet VLAN documentation, and a Microsoft Teams architecture discussion. Use each source for the behavior it documents, but do not assume that a Junos option, Mist workflow, or Fortinet term maps directly to AND-802 objectives. Confirm the exam owner’s product scope before investing heavily in vendor-specific commands.
What is a practical AND-802 study roadmap?
A useful roadmap moves from protocol structure to authentication choices, then to policy interactions and troubleshooting. At every stage, produce something testable: a role diagram, a method comparison, a fallback decision tree, a fault-isolation checklist, and a short explanation of why a selected design is appropriate. This creates evidence of understanding without depending on live exam content.
Stage one: establish the foundation
Read the Junos access-control overview and Mist authentication overview. Define supplicant, authenticator, authentication server, EAP, EAPoL, RADIUS, 802.1X, MAC RADIUS, MAB, and captive portal in your own words. Then explain why DHCP is available at different points in the 802.1X, MAC RADIUS, and captive portal flows. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html] [https://www.juniper.net/documentation/us/en/software/mist/mist-access/topics/topic-map/access-assurance-authentication-methods.html]
Stage two: master endpoint method selection
Create a matrix with managed laptops, certificate-capable phones, printers, IP phones, guest devices, and BYOD endpoints. For every row, choose a primary method, identify the required client capability, state the fallback or exception, and record the security concern. Mark statements that are recommendations separately from statements directly documented by Juniper.
Stage three: practise configuration reasoning
Study the documented fallback order, authentication-order override, MAC RADIUS behavior, server-reject VLAN, static MAC bypass, and mac-radius-restrict effect. Write “what happens next?” prompts for each configuration. Include the restriction involving MAC RADIUS and captive portal, and remember that enabling both requires 802.1X on the interface. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
Stage four: troubleshoot deliberately
Work through failures in a fixed order: endpoint capability, supplicant state, EAPoL exchange, authenticator configuration, RADIUS reachability, server policy, authorization result, and address assignment. For each failure, write the observation that would distinguish it from the next failure. This converts a broad topic into a repeatable diagnostic method.
Stage five: perform a readiness review
Before scheduling, explain the full 802.1X exchange without notes, compare certificate and credential approaches, select a method for a non-802.1X device, and predict the result of a fallback configuration. Also check the official exam owner for current objectives, eligibility, delivery, and registration information because those AND-802 details are absent from the supplied snapshot.
How can you decide whether to schedule?
Schedule only after you have verified the current official exam information and can demonstrate the technical behaviors in your own words. A sensible readiness decision is based on coverage of the confirmed objectives, ability to reason through unfamiliar scenarios, and a clear plan for any missing product-specific knowledge—not on a third-party claim that a particular score or question set predicts success.
Use a source-controlled checklist
Keep a checklist with three labels: directly documented, practical recommendation, and still unverified. Directly documented items include the 802.1X roles, EAPoL and RADIUS relationship, pre-DHCP authentication for 802.1X and MAC RADIUS, fallback behavior, and the mac-radius-restrict consequence. Unverified items should remain open until confirmed by the official exam source. [https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html]
Verify the administrative details separately
Do not let technical readiness substitute for registration verification. Confirm the exam’s owner, current status, objectives, prerequisites, delivery method, available languages, scheduling process, identification requirements, and retake policy directly from the official listing. None of those administrative facts were supplied here, so this guide intentionally does not provide values for them.
Choose the next action
If your role and protocol explanations are weak, return to the architecture sequence. If method selection is weak, build more endpoint scenarios. If configuration outcomes are weak, draw fallback decision trees. If troubleshooting is weak, practise separating supplicant, authenticator, RADIUS, policy, and DHCP evidence. If all are strong, validate the official exam details and schedule according to your own readiness and availability.
Conclusion
The strongest preparation path for AND-802, given the supplied evidence, is to understand how 802.1X controls access, how EAPoL and RADIUS divide the exchange, how certificate, credential, MAC-based, bypass, and captive portal methods serve different endpoint conditions, and how fallback changes the result. Keep unsupported exam logistics and blueprint claims out of your plan. Confirm the current official objectives before booking, then use scenario-based explanations and controlled troubleshooting practice to close the remaining gaps.
Related exams
- AND-801 exam — Android Application Development v8
- AND-803 exam — Android Applications UI/UX Design and Monetization Techniques
