300-715 · Question #91
A network engineer needs to ensure that the access credentials are not exposed during the 802.1x authentication among components. Which two protocols should complete this task?
The correct answer is A. PEAP E. EAP-TTLS. PEAP and EAP-TTLS are the two protocols that establish a secure tunnel to protect access credentials from exposure during 802.1x authentication.
Question
A network engineer needs to ensure that the access credentials are not exposed during the 802.1x authentication among components. Which two protocols should complete this task?
Options
- APEAP
- BEAP-MD5
- CLEAP
- DEAP-TLS
- EEAP-TTLS
How the community answered
(52 responses)- A90% (47)
- B4% (2)
- C2% (1)
- D4% (2)
Why each option
PEAP and EAP-TTLS are the two protocols that establish a secure tunnel to protect access credentials from exposure during 802.1x authentication.
PEAP (Protected EAP) establishes a TLS tunnel between the client and the authentication server before sending the actual user credentials, thus protecting them from exposure.
EAP-MD5 is considered weak and sends the username in cleartext, making it susceptible to dictionary attacks and credential exposure.
LEAP (Lightweight EAP) is a Cisco proprietary protocol known for weak password hashing and vulnerabilities to dictionary attacks, exposing credentials.
While EAP-TLS is a highly secure EAP method that protects credentials, the question asks for two protocols and this choice is not paired with another correct option.
EAP-TTLS (Tunneled TLS) also establishes a secure TLS tunnel before transmitting user credentials, ensuring they are encrypted and not exposed during the authentication process.
Concept tested: EAP Methods for Secure Credential Exchange
Source: https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/admin_guide/b_ISE_admin_3_1/m_eap_protocol_support.html
Topics
Community Discussion
No community discussion yet for this question.