Which mechanism enforces AAA network access when an endpoint lacks an 802.1X supplicant?

MAC Authentication Bypass (MAB) is the correct answer because it allows devices without 802.1X supplicants (like printers or IP phones) to authenticate to the network using their MAC addresses. The network access device (e.g., a switch) sends the MAC address to an AAA server (like Cisco ISE) for authentication and authorization. MACsec (Media Access Control Security) provides hop-by-hop encryption and integrity for Ethernet frames, not authentication for non-802.1X devices. Private VLANs segment a broadcast domain into isolated or community subdomains, enhancing security within a VLAN but not providing an authentication mechanism for endpoints. Port security restricts the number of MAC addresses allowed on a port and can statically assign MAC addresses, but it doesn't offer a dynamic authentication method for devices lacking 802.1X.