A security architect is designing an enterprise Network Access Control (NAC) architecture to secure corporate wired and wireless infrastructure. The design requires mutual authentication between client devices and the network, along with centralized authentication and authorization against the enterprise identity store. Which of the following components or protocols should be integrated to meet these requirements? (Select TWO.)
- A centralized RADIUS server integrated with the enterprise directory service to evaluate network access requests.Answer
- Extensible Authentication Protocol-TLS (EAP-TLS) configured across endpoints and network devices to enable certificate-based mutual authentication.Answer
- CAn OAuth 2.0 authorization server deployed at network switch ports to issue access tokens for Layer 2 hardware address filtering.
- DA Security Assertion Markup Language (SAML) web browser profile configured to handle network-layer EAP handshake framing.
Answer
The correct architecture requires a centralized RADIUS server integrated with enterprise directory services and EAP-TLS protocol configuration for mutual certificate-based authentication.
Implementing a centralized RADIUS server provides the AAA infrastructure required to evaluate access policies and connect to corporate directory services. Combining RADIUS with EAP-TLS satisfies the mutual authentication constraint through two-way X.509 certificate validation during network admission.
Step-by-Step Solution
Key Concept
Network Access Control and AAA Architecture (EAP-TLS & RADIUS)