Examkin

Question

Difficulty: HardWireless Security and Authentication

A network administrator is hardening a financial institution's wireless infrastructure to comply with updated security policies. The requirements state that all connecting wireless clients must authenticate individually using client-side digital certificates against a central RADIUS server, and the access points must completely eliminate susceptibility to wireless protocol downgrade attacks. Which TWO of the following configurations should the administrator implement to meet these requirements?

  1. Configure EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) on the RADIUS server and access points.Answer
  2. Disable WPA2/WPA3 Transition (Mixed) Mode on the wireless access points.Answer
  3. C
    Deploy WPA3-Personal utilizing Simultaneous Authentication of Equals (SAE) with a 64-character pre-shared passphrase.
  4. D
    Configure PEAP-MSCHAPv2 as the primary authentication protocol for wireless clients.

Answer

The administrator must configure EAP-TLS as the authentication protocol and disable WPA2/WPA3 Transition Mode on the access points.
Implementing EAP-TLS ensures mutual authentication via digital certificates (requiring both client and RADIUS server certificates). Disabling WPA2/WPA3 Transition Mode forces all connecting devices to negotiate pure WPA3 security mechanisms, effectively mitigating potential protocol downgrade vulnerabilities.

Step-by-Step Solution

1
Analyze authentication protocol requirements for client certificates.
Identify EAP-TLS as the standard 802.1X protocol that mandates client-side and server-side digital certificates for mutual authentication.
PEAP and EAP-TTLS typically use password-based inner authentication (such as MSCHAPv2) with only server certificates, failing the mandatory client certificate policy.
2
Evaluate access point operational modes to prevent downgrade vectors.
Select disabling WPA2/WPA3 Transition Mode to enforce exclusive WPA3 Enterprise operation.
Transition mode permits legacy WPA2 client associations, leaving the network exposed to protocol downgrade attacks.

Key Concept

WPA3 Enterprise authentication architecture using EAP-TLS and 802.1X/RADIUS controls.
Estimated Time:2m 0s
Rate this question

Topics

Wireless Security and Authentication

More questions from this topic