Examkin

Question

Difficulty: HardWireless Security and Authentication

A security engineer is configuring an 802.1X wireless infrastructure for a company's mobile workforce. Organization policy mandates strong server authentication and encrypted credential transmission, but explicitly prohibits deploying client-side digital certificates onto user devices to minimize administrative overhead. Employees must authenticate using their existing domain password credentials. Which authentication protocol best satisfies all of these criteria?

  1. EAP-TTLSAnswer
  2. B
    EAP-TLS
  3. C
    WPA2-PSK with AES-CCMP
  4. D
    MAC address filtering with WEP-128

Answer

EAP-TTLS (Extensible Authentication Protocol-Tunneled Transport Layer Security) is the correct protocol because it requires a digital certificate only on the authentication server while tunneling password authentication for clients.
EAP-TTLS (Extensible Authentication Protocol-Tunneled Transport Layer Security) sets up a secure, encrypted TLS tunnel using a certificate installed on the authentication (RADIUS) server. Clients can then authenticate within this encrypted tunnel using standard domain passwords (e.g., via MS-CHAPv2 or PAP), eliminating the administrative burden of issuing and managing client-side digital certificates.

Step-by-Step Solution

1
Analyze the authentication requirements
Identified the need for 802.1X individual domain user authentication, server verification, and no client-side digital certificates.
Administrative constraints explicitly restrict deploying client certificates across mobile endpoints.
2
Compare 802.1X EAP authentication types
EAP-TLS requires certificates on both server and client. EAP-TTLS (and PEAP) requires a certificate only on the RADIUS server to create an encrypted TLS tunnel.
EAP-TTLS allows client credentials (such as MS-CHAPv2 or PAP) to be safely passed inside the server-authenticated TLS tunnel.
3
Select the compliant protocol option
EAP-TTLS matches all security and operational criteria without introducing client certificate management overhead.
It fulfills the requirement for secure domain credential transmission without violating the client certificate restriction.

Key Concept

Distinction between EAP-TLS (requires client and server certificates) and tunneled EAP methods like EAP-TTLS (requires server certificate only).
Rate this question

Topics

Wireless Security and Authentication

More questions from this topic