AND-802
Android Security Essentials
AND-802 Exam Guide: Build Practical 802.1X and Network Access Control Knowledge
AND-802 preparation should begin with a scope check: the supplied official research does not include an exam blueprint, candidate prerequisites, scoring model, delivery format, or scheduling rules. It does provide authoritative material on 802.1X, RADIUS, MAC-based authentication, captive portals, certificate and credential methods, and access-control behavior. This guide uses that evidence to help network and access-control practitioners decide what to study first, which troubleshooting distinctions to master, and which exam details must be confirmed with the official provider before booking.
What should an AND-802 candidate verify before studying?
Confirm the exam owner’s current objective list, eligibility rules, delivery options, and registration instructions before treating any topic as examinable. The supplied research snapshot contains technical documentation rather than an AND-802 blueprint, so the study priorities below are evidence-led preparation recommendations, not an official domain weighting or complete statement of exam coverage.
Use the official exam page or certification portal associated with AND-802 to verify the exam’s full title, intended certification path, prerequisites, test language, question format, time limit, passing standard, retake policy, price, and available appointments. None of those details is established by the supplied sources, and they can change independently of the networking documentation.
Do not infer an exam’s scope from the code alone. A candidate may reasonably use the supplied 802.1X material to build technical understanding, but should not assume that every Junos or Mist configuration detail appears on AND-802. Treat the documentation as a study foundation until the official objectives confirm the boundaries.
Who benefits most from this preparation path?
This study path suits network administrators, access-control engineers, wireless practitioners, and security professionals who need to reason about authenticated LAN or WLAN access. It is especially useful for candidates who must distinguish a responsive 802.1X client from a non-802.1X device and select an appropriate fallback without weakening access controls.
Candidates working with Junos or Juniper Mist material will find the supplied sources directly relevant to the terminology and behavior described here. The concepts also transfer to mixed-vendor environments: a supplicant requests access, an authenticator controls the port or interface, and an authentication server validates the credentials through RADIUS.
A beginner can use the guide as a conceptual sequence, but should first learn Ethernet switching, DHCP, VLAN concepts, EAP, RADIUS, and basic wired and wireless access control. An experienced engineer should spend less time memorizing definitions and more time explaining packet flow, failure states, method order, and the operational consequences of each design choice.
Which skills should the study plan emphasize?
Prioritize explanation and diagnosis over isolated term memorization. The supplied evidence supports five practical skill areas: describing the 802.1X roles and protocol exchanges, distinguishing authentication methods, reasoning about fallback and bypass behavior, selecting certificate or credential approaches, and predicting what traffic is permitted before authentication completes.
The official material identifies 802.1X as an IEEE standard for port-based network access control. It describes EAPoL between the end device and the network device, and RADIUS between the network device and the authentication server. A strong candidate should be able to place each protocol and role in the access sequence rather than treating 802.1X, EAP, and RADIUS as interchangeable names.
You should also be able to reason about address assignment. For 802.1X and MAC RADIUS authentication, the end device must be authenticated before receiving an IP address from DHCP. Captive portal authentication differs because the device is allowed to acquire an IP address so that it can be redirected to a login page. Source: https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html
The Mist documentation adds a security-design dimension. It identifies EAP-TLS as certificate-based and EAP-TTLS/PAP as credential-based, while also describing non-802.1X methods such as MAC Authentication Bypass and Multi Pre-Shared Key. Prepare to explain why a method fits a device population, not merely to expand its acronym. Source: https://www.juniper.net/documentation/us/en/software/mist/mist-access/topics/topic-map/access-assurance-authentication-methods.html
How does the 802.1X access sequence work?
Learn the sequence as a cause-and-effect model: the supplicant requests network access, the authenticator controls the interface, and the authentication server validates the identity. During authentication, ordinary traffic is restricted, and access changes only after the server validates the presented credentials.
A LAN 802.1X configuration has three basic components. The supplicant, also called the end device, requests network access. The authenticator is the device that controls access by blocking traffic to and from the end device until authentication succeeds. The authentication server holds or checks the identity information and communicates with the authenticator through RADIUS.
The Junos documentation states that EAPoL is EAP designed for Ethernet networks. It also states that, while 802.1X authentication is in process, only 802.1X traffic and control traffic can transit the network; DHCP and HTTP traffic are blocked at the data-link layer. Use this behavior to answer troubleshooting questions about why a client has link but no usable address or web access. Source: https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html
Build a simple diagram in your notes with three columns: supplicant, authenticator, and RADIUS server. Under each column, record the messages or decisions that belong there. Then add a timeline for a successful session and a second timeline for an incorrect credential. This is more reliable than memorizing a paragraph because it exposes role confusion quickly.
Mistake to avoid: describing the switch or access point as the authentication server. The network device is the authenticator in the supplied Junos description; RADIUS is the communication path to the authentication server. Keeping those responsibilities separate helps when diagnosing certificate, shared-secret, reachability, or policy failures.
How should you compare EAP-TLS with credential-based authentication?
Choose certificate-based study first when the scenario emphasizes device provisioning, mutual authentication, PKI, or BYOD risk. Study credential-based methods as a distinct design with different dependencies and risks. The official Mist material supports both approaches but recommends caution with password-based 802.1X where PKI is not feasible.
EAP-TLS uses digital certificates. The Mist source describes certificate-based authentication as using PKI, a private-public key pair, and secured certificate storage; client provisioning is typically performed through mobile device management. It also explains that an identity provider can be used to check user or device information, although an IdP is optional for certificate-based authentication.
EAP-TTLS/PAP is identified in the same source as a credential-based method. The Junos source explains that the credentials depend on the EAP version: EAP MD5 uses a username and password, while EAP-TLS, EAP-TTLS, and PEAP involve the relevant certificate or credential arrangements. Do not collapse all EAP methods into one authentication experience. Sources: https://www.juniper.net/documentation/us/en/software/mist/mist-access/topics/topic-map/access-assurance-authentication-methods.html and https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html
The Mist documentation states that password-based authentication can become impractical in 802.1X environments where identity providers enforce MFA. It also identifies person-in-the-middle risk and advises avoiding password-based 802.1X in networks that support BYOD because of potential MITM attack vectors. Treat this as a design recommendation from the source, not as a universal prohibition.
A useful study exercise is to compare the operational lifecycle. For certificates, list issuance, installation, renewal, revocation, device replacement, and lost-device response. For credentials, list identity-provider dependency, password handling, MFA limitations, and user support. Then explain which lifecycle creates the central risk in a given scenario.
When should MAC RADIUS, MAB, bypass, or captive portal enter the design?
Use alternative methods for device populations that cannot complete ordinary 802.1X, but keep their limitations visible. Printers, IP phones, and other single-purpose devices may lack 802.1X support; MAC-based authentication can identify them through their address, while captive portals serve a different workflow in which the device first obtains an IP address.
Junos describes MAC RADIUS authentication as useful for interfaces connected to devices that do not support 802.1X. When a non-802.1X-enabled end device is detected, the device sends its MAC address to the authentication server. This is not equivalent to certificate-based proof of identity, so study the security and policy implications rather than presenting MAB as a stronger substitute.
Static MAC bypass can be used to allow non-802.1X-enabled devices access to the LAN. A candidate should be able to explain why a known exception might be necessary, what inventory or policy control should accompany it, and why an uncontrolled bypass list can undermine the intent of port-based access control. The supplied source establishes the use case, not a universal operational policy.
Captive portal has a different address-assignment sequence. Junos states that captive portal allows end devices to acquire an IP address so they can be redirected to a login page. It also states that, if a user remains idle for more than about 5 minutes with no traffic passed, the user must log back in. Keep that documented behavior attached to captive portal rather than applying it to 802.1X generally. Source: https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html
Mistake to avoid: treating MAC authentication and captive portal as interchangeable fallback choices. Ask three questions: does the endpoint support 802.1X, can the user interact with a web login, and what level of identity assurance does the policy require? Those answers should drive the method selection.
How does fallback change the troubleshooting question?
Fallback means the first failed method does not necessarily explain the final access result. Study the configured order, the endpoint’s response, and the reason for failure together. A device may fail 802.1X because it is nonresponsive, then succeed through MAC RADIUS; another may be rejected for incorrect credentials and receive restricted access instead.
Junos states that 802.1X, MAC RADIUS, and captive portal can be configured on one interface to enable fallback when one method fails. It also states that the default order generally attempts 802.1X first when it is configured, and that the order can be overridden so that 802.1X or MAC RADIUS is attempted first. Source: https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/access-control-authentication.html
Separate a nonresponsive endpoint from a rejected endpoint. A nonresponsive end device is not 802.1X-enabled; a responsive end device is 802.1X-enabled and supplies credentials through EAP. A responsive client with incorrect credentials is a different case from a printer that never sends an 802.1X exchange. That distinction determines whether fallback to MAC RADIUS is logical.
The source also describes a server-reject VLAN for responsive 802.1X devices that sent incorrect credentials. It can provide limited LAN access, typically only to the Internet, for remediation. Note the limitation that voice traffic is dropped if the authenticated device using that server-reject VLAN is an IP phone. These details are valuable because they connect authentication outcomes with service impact.
Configuration restrictions matter. The supplied Junos facts state that MAC RADIUS and captive portal cannot both be configured on an interface without also configuring 802.1X. They also state that configuring mac-radius-restrict causes the device to drop all 802.1X packets. Before recommending either setting, identify whether the interface needs guest VLAN or another 802.1X method; the source says mac-radius-restrict is useful when no other 802.1X authentication methods are needed.
What should you know about DHCP, VLAN access, and authentication timing?
Treat authentication timing as a control-plane and user-experience issue, not merely a login detail. For 802.1X and MAC RADIUS, authentication precedes DHCP address assignment; for captive portal, address assignment precedes web authentication. This distinction helps you predict symptoms and select the right evidence during troubleshooting.
If a client has physical link but cannot obtain a DHCP lease, first ask whether the port is still in the 802.1X authentication phase. The Junos source says that only 802.1X and control traffic can pass while authentication is in process, with DHCP and HTTP blocked. That behavior can explain an apparently healthy Ethernet connection without assuming that DHCP itself is broken.
A server-reject VLAN provides a documented remediation path for certain credential failures. Study the policy intent: limited access can help a user correct an identity problem without granting ordinary network access. It is not the same as successful authentication, and it should not be described as unrestricted LAN connectivity.
Do not import assumptions from general VLAN study into an AND-802 answer unless the official objectives support them. The supplied Fortinet community source is specifically titled around the difference between 802.1Q and 802.1AD QinQ, but the research snapshot does not provide enough verified technical detail to build a complete VLAN comparison here. Use it only if the official blueprint confirms that topic. Source: https://community.fortinet.com/fortigate-3/technical-tip-understanding-the-difference-between-vlan-protocols-802-1q-and-802-1ad-qinq-144599
What practical lab work improves retention?
Build a small decision lab rather than trying to reproduce an entire enterprise. The goal is to observe method selection and failure handling: a responsive 802.1X client, a nonresponsive endpoint represented by a device without 802.1X, a RADIUS rejection, and a captive-portal path if your platform supports it. Record the expected state before changing any setting.
For each scenario, write four predictions before testing: whether EAPoL appears, whether a RADIUS request should occur, whether DHCP should succeed, and what access state should follow. Compare your prediction with platform documentation and logs. This trains the reasoning an exam question typically demands without relying on live questions or unauthorized material.
Create a method matrix with columns for endpoint capability, identity input, first authentication exchange, address-assignment timing, fallback possibility, and likely operational risk. Fill one row for EAP-TLS, one for EAP-TTLS/PAP, one for MAC RADIUS or MAB, and one for captive portal. Mark any cell that the supplied sources do not establish instead of guessing.
Use diagrams to rehearse failure paths. One diagram should show 802.1X followed by successful RADIUS validation. Another should show an endpoint that never responds and then MAC RADIUS. A third should show incorrect credentials and a server-reject VLAN. Explain why each path permits or blocks DHCP and ordinary traffic.
Avoid a lab mistake that produces false confidence: changing several variables at once. Keep the endpoint type, authentication order, RADIUS policy, and interface role stable while testing one behavior. After each test, restore the baseline and document what changed. The resulting notes become a troubleshooting reference rather than a collection of disconnected commands.
What is a focused four-stage study roadmap?
Use a staged plan that moves from protocol roles to design decisions and then to diagnosis. Because no official AND-802 blueprint or exam weighting is included in the supplied research, allocate time according to your baseline knowledge and the confirmed objectives, not according to invented percentages or assumed question coverage.
Stage one: establish the vocabulary and access sequence. Learn supplicant, authenticator, authentication server, EAP, EAPoL, and RADIUS. Draw the successful 802.1X exchange and annotate the traffic restriction during authentication. Finish this stage when you can explain why a client may be blocked before DHCP.
Stage two: compare authentication methods. Study EAP-TLS and EAP-TTLS/PAP, then compare certificate-based and credential-based authentication. Add PKI, client provisioning, identity-provider involvement, MFA constraints, and BYOD risk to the notes. Your checkpoint is a short recommendation for a managed-device environment and a separate recommendation for a mixed endpoint population.
Stage three: master exceptions and fallback. Work through MAC RADIUS, MAB, static MAC bypass, captive portal, authentication order, mac-radius-restrict, and server-reject VLAN behavior. For every item, state the endpoint problem it addresses and the security or service trade-off it introduces.
Stage four: practise diagnosis and verify exam logistics. Use configuration reading, diagrams, and controlled lab results to solve scenarios. Separately confirm the official AND-802 objectives, delivery method, appointment process, permitted identification, scoring information, and policies. Technical confidence should not substitute for an unverified booking decision.
A useful final review has three outputs: a one-page protocol map, a method-selection matrix, and a list of unresolved exam-administration questions. If you cannot explain a method without looking at notes, return to that method’s sequence and failure conditions rather than rereading broad material.
Which mistakes waste the most preparation time?
The most damaging mistake is studying an assumed blueprint. The supplied sources support 802.1X and related access-control knowledge, but they do not establish AND-802 domains, weights, question counts, duration, or passing score. Verify those items first, then narrow the study set to the official objectives.
Another common error is memorizing authentication names without learning when each method starts. A candidate may know that MAC RADIUS exists but fail to distinguish a nonresponsive endpoint from a responsive client with incorrect credentials. Build every note around trigger, exchange, decision, and resulting access state.
Do not describe captive portal as though it blocks DHCP before login. The supplied Junos documentation distinguishes it from 802.1X and MAC RADIUS by allowing an IP address so the device can be redirected to a login page. Keep address assignment and authentication timing tied to the correct method.
Do not recommend password-based 802.1X for BYOD without addressing the documented MITM concern. The Mist source recommends avoiding that approach in BYOD environments and presents certificate-based authentication as the stronger direction where PKI is feasible. Explain the deployment constraint rather than presenting a certificate migration as effortless.
Do not use leaked questions, exam dumps, or memorized answer keys. They do not replace understanding protocol roles, configuration interactions, or security trade-offs, and they can encourage answers that conflict with the current official documentation. Use published vendor material, controlled practice, and your own reasoning notes instead.
Finally, avoid over-labelling vendor behavior as a protocol rule. Some statements in the supplied sources describe Junos or Mist implementation behavior. In your notes, label each item as an IEEE concept, a vendor-supported method, or a platform-specific configuration effect. That classification makes your answers more precise.
What should you do before booking AND-802?
Book only after the official exam provider confirms the current administrative details and your study evidence shows that you can reason through access-control scenarios without prompts. The supplied research does not establish a booking date, delivery mode, price, language, duration, score, or prerequisite, so those decisions require a current official source.
First, locate the authoritative AND-802 certification page and compare its objectives with your method matrix. Highlight topics that are absent from the supplied 802.1X sources and add only those supported by the official blueprint or documentation. Do not fill gaps with guesses based on the exam code.
Next, test yourself using fresh scenarios that ask for a decision, not a definition. Examples include selecting a method for a non-802.1X printer, explaining why DHCP is unavailable during 802.1X authentication, choosing between EAP-TLS and credential-based authentication, and diagnosing why a configured authentication order produces an unexpected result.
Then review your operational assumptions. Confirm that you understand the interface restrictions, fallback combinations, server-reject behavior, certificate lifecycle, and the security implications of MAC-based exceptions. If you are preparing for a vendor-specific exam, repeat the review using the relevant Junos or Mist terminology and configuration guide.
Your final action is administrative: read the provider’s current candidate instructions, confirm identity and equipment requirements if applicable, and schedule only when the appointment conditions suit your preparation. Keep a saved copy or note of the official page date because time-sensitive exam rules should never be inferred from a third-party guide.
Conclusion
The strongest AND-802 preparation decision is to separate verified exam administration from evidence-based technical study. Until an official blueprint is available, focus on the supplied access-control foundations: 802.1X roles and traffic behavior, EAPoL and RADIUS, certificate and credential methods, MAC-based alternatives, captive portal timing, fallback order, and restricted remediation access. Turn those topics into diagrams, method comparisons, and failure-path exercises, then reconcile the plan with the current official exam objectives before scheduling.
Related exams
- AND-801 exam — Android Application Development v8
- AND-803 exam — Android Applications UI/UX Design and Monetization Techniques