Within an 802.1X enabled network with the Auth Fail feature configured, when does a switch port get placed into a restricted VLAN?

Within an 802.1X enabled network with the Auth Fail feature configured, when does a switch port get placed into a restricted VLAN?
A . When 802.1X is not globally enabled on the Cisco catalyst switch
B . When AAA new-model is enabled
C . When a connected client fails to authenticate after a certain number of attempts
D . If a connected client does not support 802.1X
E . After a connected client exceeds a specific idle time

Answer: C