300-370 · Question #142
All corporate-issued devices in your network have been configured with EAP-TLS authentication. They authenticate via wireless to an instance of Cisco ISE and AD authorization for the user profiles…
The correct answer is D. WLAN connectivity is not impacted because EAP-TLS uses certificates. When EAP-TLS is used for authentication, an expired Active Directory username and password will not affect WLAN connectivity because EAP-TLS relies on client-side and server-side certificates for identity validation, not user credentials.
Question
All corporate-issued devices in your network have been configured with EAP-TLS authentication. They authenticate via wireless to an instance of Cisco ISE and AD authorization for the user profiles is un-configured. Which impact occurs to the authentication when a user's Active Directory username and password expires?
Options
- AThe ISE prompts the user for the new password.
- BThe user must change the password manually on their WLAN profile.
- CThe WLAN profile must be forgotten and reconfigured.
- DWLAN connectivity is not impacted because EAP-TLS uses certificates.
How the community answered
(29 responses)- A7% (2)
- B3% (1)
- C3% (1)
- D86% (25)
Why each option
When EAP-TLS is used for authentication, an expired Active Directory username and password will not affect WLAN connectivity because EAP-TLS relies on client-side and server-side certificates for identity validation, not user credentials.
EAP-TLS does not involve username/password prompts during the authentication flow; it uses certificates for identity.
EAP-TLS WLAN profiles do not typically store or require manual password changes for authentication, as certificates are used.
This is unnecessary because the certificate-based authentication mechanism remains valid even if the user's AD password expires.
EAP-TLS authentication uses client-side digital certificates to authenticate the user or device, and a server-side certificate to authenticate the RADIUS server to the client. Since the authentication process relies solely on these certificates, an expired Active Directory username and password for the user has no impact on the wireless connectivity, especially because AD authorization for user profiles is un-configured.
Concept tested: EAP-TLS authentication mechanism
Source: https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-plan-eap#eap-tls
Topics
Community Discussion
No community discussion yet for this question.