Examkin

Question

Difficulty: HardPassword Security Policies, MFA, and Certificates

A network administrator is implementing administrative security controls for enterprise network switches and configuring Public Key Infrastructure (PKI) certificate validation for HTTPS management access. When evaluating multi-factor authentication (MFA) factor categories and PKI digital certificate validation mechanics, which two statements are correct?

  1. An RSA hardware key fob generating a time-based passcode combined with a user password satisfies MFA by combining a possession factor with a knowledge factor.Answer
  2. During TLS certificate verification, the client uses the issuer Certificate Authority's public key to validate the digital signature on the switch certificate.Answer
  3. C
    A software certificate stored on a user workstation and a domain user account password both belong to the knowledge factor authentication category.
  4. D
    During certificate validation, the client uses the switch private key to decrypt the digital signature applied by the Certificate Authority.
  5. E
    Enforcing password complexity and aging policies on local switch databases automatically encrypts the underlying SSH session payloads.

Answer

The correct statements are that combining an RSA hardware key fob passcode with a password satisfies MFA by using possession and knowledge factors, and that during TLS certificate verification, the client relies on the issuing Certificate Authority's public key to validate the switch certificate's digital signature.
Combining a hardware token generator (something you have) with a user password (something you know) uses two distinct authentication factor categories, satisfying true MFA requirements. Additionally, in PKI validation, clients verify the CA's signature on a switch's X.509 certificate using the CA's public key contained in their local trust store.

Step-by-Step Solution

1
Analyze the authentication factors in the proposed MFA scenario.
A hardware token generating a one-time passcode is a physical possession factor ('something you have'), while a standard password is a knowledge factor ('something you know'). Combining two distinct categories fulfills multi-factor authentication requirements.
MFA requires authentication elements from at least two different categories among knowledge, possession, and inherence.
2
Evaluate the PKI digital certificate signature verification mechanism.
When a Certificate Authority (CA) issues an X.509 certificate to a switch, the CA signs the certificate hash using the CA's private key. The connecting client verifies this signature using the CA's public key contained in its trusted root store.
Asymmetric cryptography dictates that data signed by a private key can only be verified using the corresponding public key.
3
Identify misclassifications and incorrect cryptographic roles in the remaining choices.
Digital certificates function as possession factors (not knowledge factors), signature verification utilizes the CA public key (never the switch private key), and password policies regulate password properties rather than session transport encryption.
Distinguishing between factor types, public/private key roles in PKI, and authentication versus transport encryption avoids operational security misconceptions.

Key Concept

Multi-Factor Authentication (MFA) Factor Classification and PKI Digital Certificate Verification
Rate this question

Topics

Password Security Policies, MFA, and Certificates

More questions from this topic