Examkin

Question

Difficulty: Very hardPassword Security Policies, MFA, and Certificates

An organization is deploying 802.1X authentication using EAP-TLS to secure network access. During testing, a user laptop fails the TLS handshake when attempting to authenticate against the Cisco Identity Services Engine (ISE) RADIUS server. Inspection of the server logs reveals that the client presented a valid user certificate issued by an Intermediate Certificate Authority (CA), and the root CA certificate is present in the server's trusted store. However, the handshake fails because ISE cannot verify whether the client certificate has been revoked due to an unreachable Revocation Check endpoint. Which mechanism or component must be accessible to resolve this authentication failure?

  1. An accessible Online Certificate Status Protocol (OCSP) responder or Certificate Revocation List (CRL) distribution pointAnswer
  2. B
    A TACACS+ server configured to encrypt the certificate payload during the authorization phase
  3. C
    A dynamic access control list (dACL) on the switch port that explicitly permits HTTP traffic to the root CA
  4. D
    A newly generated Certificate Signing Request (CSR) submitted by the RADIUS server to update its sticky MAC database

Answer

An accessible Online Certificate Status Protocol (OCSP) responder or Certificate Revocation List (CRL) distribution point is required.
In Public Key Infrastructure (PKI), validating a digital certificate requires checking four primary criteria: signature validity, current date within the validity period, trust chain up to a trusted Root CA, and certificate revocation status. When a RADIUS server (such as Cisco ISE) performs EAP-TLS authentication, it verifies whether the client certificate has been revoked prior to expiration. This verification relies on accessing either a Certificate Revocation List (CRL) from a CDP or querying an Online Certificate Status Protocol (OCSP) responder. If these endpoints are unreachable, revocation status cannot be verified, causing the handshake to fail.

Step-by-Step Solution

1
Analyze the EAP-TLS authentication flow and failure symptom.
The client presented a valid certificate from a trusted CA hierarchy, but authentication failed specifically due to an unverified revocation status.
During TLS certificate validation, the verifying party (RADIUS server) checks certificate signature, validity dates, trust chain, and revocation status.
2
Identify the required PKI component for checking certificate revocation status.
Digital certificate revocation status is checked via Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP) queries.
If the RADIUS server cannot reach the CRL Distribution Point (CDP) or OCSP responder, and strict revocation checking is enabled, certificate validation fails.

Key Concept

Public Key Infrastructure (PKI) Certificate Validation & Revocation Checking (CRL/OCSP)
Rate this question

Topics

Password Security Policies, MFA, and Certificates

More questions from this topic