Drag and Drop Question An organization wants to implement 802.1X and is debating whether to use PEAP-MSCHAPv2 or PEAP-EAP-TLS for authentication. Drag the characteristics on the left to the correspond

Question

Exhibit

Answer Area

Explanation

The question requires correctly categorizing the operational characteristics of PEAP-MSCHAPv2 and PEAP-EAP-TLS authentication protocols based on whether they use usernames/passwords or certificates for identification and how they manage credentials.

Approach. To answer correctly, each characteristic must be dragged to the protocol it describes.

For PEAP-MSCHAPv2:

• 'uses username and password for authentication': MSCHAPv2 is a password-based authentication protocol where users authenticate with a username and password. PEAP encapsulates this method.
• 'changes credentials through the admin portal': Username and password credentials, especially in corporate environments, are typically managed (changed, reset) by administrators through identity management systems, often accessible via an admin portal (e.g., Active Directory Users and Computers).
• 'supports fragmentation after the tunnel is established': PEAP (Protected EAP) establishes a TLS tunnel. EAP fragmentation can occur for the inner EAP method after this secure tunnel is established, which applies to PEAP-MSCHAPv2 as well as PEAP-EAP-TLS. This is a general capability of PEAP to handle larger authentication exchanges.

For PEAP-EAP-TLS:

• 'uses certificates for authentication': EAP-TLS (Extensible Authentication Protocol - Transport Layer Security) is a certificate-based authentication method. Both the client and the server typically use X.509 digital certificates for mutual authentication.
• 'uses the X.509 format': Since EAP-TLS relies on digital certificates for authentication, these certificates are universally based on the X.509 standard format.
• 'supports auto-enrollment for obtaining credentials': Digital certificates, particularly in enterprise environments with a Public Key Infrastructure (PKI), can be automatically provisioned and renewed on client devices through certificate auto-enrollment policies.

Common mistakes.

• common_mistake. A common mistake is confusing the authentication mechanisms. For instance, dragging 'uses certificates for authentication' to PEAP-MSCHAPv2 would be incorrect because MSCHAPv2 is username/password-based, not certificate-based. Similarly, misplacing 'uses username and password for authentication' under PEAP-EAP-TLS is wrong as EAP-TLS uses certificates. Another error would be to associate 'changes credentials through the admin portal' with PEAP-EAP-TLS, as certificates are typically issued, revoked, and renewed by a Certificate Authority, not 'changed' via an admin portal in the same way a password is. Incorrectly assigning 'uses the X.509 format' to PEAP-MSCHAPv2 demonstrates a lack of understanding that X.509 is the standard for certificates used in PKI, which is fundamental to EAP-TLS, not password-based methods.

Concept tested. The core concept tested is the ability to differentiate between PEAP-MSCHAPv2 and PEAP-EAP-TLS authentication methods in an 802.1X environment, specifically understanding their underlying authentication mechanisms (password vs. certificate), credential management, and related technical standards like X.509 and fragmentation capabilities.

No community discussion yet for this question.