Examkin

Soru

Zorluk: Çok zorPassword Security Policies, MFA, and Certificates

An enterprise organization is updating its infrastructure security baseline to comply with zero-trust architecture guidelines. The network security team is establishing policies governing administrative SSH access to core switches and 802.1X EAP-TLS client authentication across corporate wireless networks. Which TWO of the following implementation details correctly align with Cisco recommended standards for multi-factor authentication (MFA) factor classification and Public Key Infrastructure (PKI) digital certificate validation? (Choose two.)

  1. Prompting an administrator for a complex local console password alongside a hardware TOTP token generator fulfills multi-factor authentication by combining a knowledge factor with a possession factor.Cevap
  2. Validating an incoming client digital certificate during an 802.1X TLS handshake requires verifying the Certificate Authority signature chain, checking current timestamp validity, and querying a CRL or OCSP server to confirm the certificate has not been revoked.Cevap
  3. C
    Requiring a user to enter an SMS one-time passcode followed by approving a mobile push notification on their smartphone constitutes valid multi-factor authentication because two distinct transport mechanisms are utilized.
  4. D
    Client digital certificates are automatically considered valid and fully trusted without performing active CRL or OCSP queries as long as the issuing Root Certificate Authority certificate is installed in the local trust store.
  5. E
    Enforcing a mandatory password expiration policy of 30 days eliminates the necessity for minimum password length or character complexity requirements on administrative network device accounts.

Cevap

The statements confirming that combining an administrative password with a hardware TOTP token fulfills MFA by pairing knowledge and possession factors, and that digital certificate validation mandates verifying signatures, validity dates, and CRL/OCSP revocation status are both correct.
Pairing a password (knowledge factor) with a hardware TOTP token generator (possession factor) correctly spans two distinct MFA factor categories. Additionally, PKI certificate validation strictly requires verifying the issuer chain, confirming current expiration bounds, and validating non-revocation status using CRL or OCSP.

Adım Adım Çözüm

1
Evaluate Multi-Factor Authentication (MFA) category criteria.
MFA mandates selecting authentication mechanisms from at least two separate factor categories: knowledge (something you know), possession (something you have), or inherence (something you are).
Using multiple methods within the exact same category (such as two separate phone-based alerts) fails the factor independence requirement.
2
Examine Public Key Infrastructure (PKI) certificate verification procedures.
Comprehensive certificate verification requires validating the issuing CA trust path, confirming the current time falls within the validity window, and checking revocation lists (CRL) or real-time status responders (OCSP).
A certificate signed by a trusted root CA can still be revoked due to private key compromise or endpoint decommission before its expiration date.

Anahtar Kavram

MFA Factor Classification and PKI Digital Certificate Revocation Verification
Bu soruyu puanla

Konular

Password Security Policies, MFA, and Certificates

Bu konudan daha fazla soru