nerdexam
Cisco

352-001 · Question #70

A company has these requirements for access to their wireless and wired corporate LANs using 802.1x: - Client devices that are corporate assets and have been joined to the Active Directory domain…

The correct answer is B. Extensible Authentication Protocol-Transport Layer Security with machine authentication. EAP-TLS with machine authentication uses computer certificates issued to domain-joined devices, ensuring only corporate assets can authenticate and providing mutual authentication.

Designing Security

Question

A company has these requirements for access to their wireless and wired corporate LANs using 802.1x:

  • Client devices that are corporate assets and have been joined to the Active Directory domain are

allowed access.

  • Personal devices must not be allowed access.
  • Clients and access servers must be mutually authenticated.

Which solution meets these requirements?

Options

  • AProtected Extensible Authentication Protocol/Microsoft Challenge Handshake Authentication Protocol
  • BExtensible Authentication Protocol-Transport Layer Security with machine authentication
  • CExtensible Authentication Protocol-Transport Layer Security with user authentication
  • DProtected Extensible Authentication Protocol/Microsoft Challenge Handshake Authentication Protocol

How the community answered

(46 responses)
  • A
    15% (7)
  • B
    74% (34)
  • C
    7% (3)
  • D
    4% (2)

Why each option

EAP-TLS with machine authentication uses computer certificates issued to domain-joined devices, ensuring only corporate assets can authenticate and providing mutual authentication.

AProtected Extensible Authentication Protocol/Microsoft Challenge Handshake Authentication Protocol

PEAP/MSCHAPv2 authenticates using user credentials (username and password), which a personal device owner could supply, so it cannot restrict access to corporate-asset machines.

BExtensible Authentication Protocol-Transport Layer Security with machine authenticationCorrect

EAP-TLS with machine authentication requires a valid X.509 certificate installed on the client machine, which Active Directory domain-joined corporate devices receive via Group Policy - personal devices lack these certificates and are denied access. The TLS handshake also authenticates the RADIUS server to the client, satisfying the mutual authentication requirement.

CExtensible Authentication Protocol-Transport Layer Security with user authentication

EAP-TLS with user authentication relies on user certificates rather than machine certificates, meaning a user could authenticate from a personal device if the user certificate is present or portable.

DProtected Extensible Authentication Protocol/Microsoft Challenge Handshake Authentication Protocol

PEAP/MSCHAPv2 (same as choice A) relies on user credentials and cannot enforce that only domain-joined corporate machines gain access.

Concept tested: EAP-TLS machine authentication for device-based 802.1x access control

Source: https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-top

Topics

#802.1x#EAP-TLS#machine authentication#Active Directory

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 352-001 Practice