If an endpoint lacks an 802.1X supplicant, which mechanism can enforce AAA-based network access authentication?

WebAuth (Web Authentication) is the correct choice. It provides AAA-based network access for devices without an 802.1X supplicant by redirecting their web browser to a captive portal for authentication. This is common for guest access or IoT devices. MACsec (Media Access Control Security) provides Layer 2 encryption and integrity, not an authentication mechanism for supplicant-less devices. Private VLANs segment traffic within a VLAN but don't offer an authentication method. Port security restricts access based on MAC addresses learned on a port, but it's a security feature, not an AAA-based authentication method for new devices.