Which access layer threat-mitigation technique provides security based on identity?

The verified answer is C. 802.1X provides identity-based access control at the access layer. A supplicant authenticates through the switch or AP to an authentication server before receiving network access. Cisco CCNA 200-301 v1.1 places this skill in Security Fundamentals, where the exam expects a working understanding of how the feature behaves on real Cisco networks, not just a memorized command. DAI, DHCP snooping, and native VLAN changes protect Layer 2 infrastructure but do not authenticate user or device identity in the same way. In production, this distinction matters because a misapplied command or design choice usually creates an outage, a security gap, or unnecessary troubleshooting noise. The correct choice matches the control-plane, data-plane, wireless, security, or services behaviour described in the scenario and should be preferred over options that merely sound related.