Examkin

Question

Difficulty: Very hardIdentity and Access Management Operations

A security analyst is auditing access logs following an unauthorized privilege escalation incident on a network perimeter gateway. The organization utilizes a centralized RADIUS server integrated with Directory Services for network access control. The authentication and authorization logs display the following consecutive events:

[TIMESTAMP: 2026-07-27T14:22:01Z] RADIUS-Auth: User 'j_doe' successfully authenticated via MS-CHAPv2.
[TIMESTAMP: 2026-07-27T14:22:02Z] RADIUS-Authz: Vendor-Specific Attribute (VSA) 'Cisco-AVPair = shell:priv-lvl=15' rejected due to policy schema syntax mismatch.
[TIMESTAMP: 2026-07-27T14:22:03Z] Gateway-Daemon: Fallback default authorization rule applied; assigned administrative profile (privilege level 15) to session 'j_doe'.

Which of the following operational vulnerabilities is the primary root cause of the unauthorized privilege escalation?

  1. A failure in authorization attribute processing triggered an insecure default fallback configuration on the gateway.Answer
  2. B
    The authentication protocol failed to validate the identity credentials of the user before issuing session access.
  3. C
    The RADIUS server failed to enforce continuous Zero Trust inspection on internal perimeter network traffic.
  4. D
    An attacker harvested valid user credentials by sniffing unencrypted authentication exchanges across the network.

Answer

A failure in authorization attribute processing triggered an insecure default fallback configuration on the gateway.
The log output shows successful authentication followed by a failure in authorization attribute syntax (Vendor-Specific Attribute). The gateway daemon's flawed logic defaulted to granting full privilege level 15 when the authorization attribute was rejected. The root cause is therefore improper authorization processing leading to an insecure fail-open default configuration.

Step-by-Step Solution

1
Analyze RADIUS authentication log entry
User 'j_doe' successfully passed authentication using MS-CHAPv2, confirming identity validation occurred correctly.
Differentiates authentication (identity proof) from authorization (permission granting).
2
Analyze RADIUS authorization VSA log entry
The Vendor-Specific Attribute intended to specify privilege level 15 failed due to a syntax error.
Identifies where the permission specification mechanism broke down.
3
Analyze Gateway Daemon fallback log entry
Upon rejection of the authorization attribute, the gateway applied a default local rule granting full privilege level 15 access.
Pinpoints the root cause as fail-open default configuration upon authorization processing failure.

Key Concept

RADIUS Vendor-Specific Attributes (VSAs) and Fail-Secure vs. Fail-Open Authorization Handling
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic