Examkin

Soru

Zorluk: OrtaAAA Framework and Authentication Methods

A network analyst inspecting a packet capture between a wireless access point and a centralized authentication server observes that while the user password field within the Access-Request frame is obscured, the username and assigned VLAN attributes are visible in cleartext. Which operational characteristic of the RADIUS protocol accounts for this observed behavior?

  1. RADIUS encrypts only the password attribute within the packet body, leaving the remaining header and attribute-value pairs unencrypted over UDP.Cevap
  2. B
    RADIUS encrypts the entire packet body using TCP, but the packet analyzer lacked the decryption key required for transport header parsing.
  3. C
    RADIUS relies on TCP port 49, which transmits authentication credentials in cleartext unless an external TLS tunnel is explicitly configured.
  4. D
    RADIUS uses UDP transport, which inherently prohibits any form of payload encryption above Layer 3.

Cevap

RADIUS encrypts only the password attribute within the packet body, leaving the remaining header and attribute-value pairs unencrypted over UDP.
The RADIUS protocol (RFC 2865) operates over UDP (typically ports 1812 for authentication/authorization and 1813 for accounting) and encrypts only the User-Password attribute using an MD5-based algorithm with the shared secret. Other attributes such as User-Name, NAS-IP-Address, and vendor-specific attributes (like VLAN assignments) remain unencrypted in the packet body.

Adım Adım Çözüm

1
Analyze the observed network packet capture characteristics
Password field is encrypted/obscured, but username and VLAN attributes are readable in cleartext.
This behavior directly matches the specific cryptographic boundary defined in the standard RADIUS protocol (RFC 2865).
2
Evaluate RADIUS protocol transport and security properties
RADIUS uses UDP (ports 1812/1813) and encrypts only the user password field using the shared secret.
Unlike TACACS+, which encrypts the entire payload over TCP port 49, RADIUS maintains unencrypted headers and RADIUS attributes to allow middleboxes to route packets.
3
Select the option describing RADIUS packet encryption boundaries
Identify the option stating that RADIUS encrypts only the password attribute while leaving the rest of the payload unencrypted over UDP.
This accurately explains why the analyst can read usernames and vendor attributes while seeing obscured passwords.

Anahtar Kavram

RADIUS vs TACACS+ Payload Encryption Boundaries
Bu soruyu puanla

Konular

AAA Framework and Authentication Methods

Bu konudan daha fazla soru