Which access-layer mitigation technique enforces identity-based access control?

802.1x is the correct answer because it provides port-based authentication, enforcing identity-based access control at the access layer. When a device connects to a switch port configured with 802.1x, it must authenticate with an authentication server (e.g., RADIUS) before gaining network access. This ensures only authorized users and devices can connect. Dynamic ARP Inspection (DAI) prevents ARP spoofing but doesn't enforce identity-based access. DHCP snooping prevents rogue DHCP servers and protects against DHCP starvation attacks, but it's not an identity-based access control mechanism. Using a non-default native VLAN is a security best practice to prevent VLAN hopping, but it doesn't authenticate users or devices.