An EAP failure message is sent to the ________.

• A. authentication server
• B. authenticator
• C. client
• D. Any of the above

Answer: (B)

In an EAP-based access scenario (like 802.1X), the authenticator sits between the client (supplicant) and the authentication server. The EAPOL frames, including the failure notification, travel between the supplicant and the authenticator. When the authentication process fails, the authenticator issues an EAP Failure message to the supplicant to indicate that access is denied and to terminate the session. The authentication server is involved in the back-and-forth through the authenticator, but it does not send the EAP Failure directly to the client. Therefore, the entity that sends the EAP failure message is the authenticator.