A Company has these requirements for access to their wireless and wired corporate LANs using 802.1x Clients devices that corporate assets and have joined the active directory domain are allowed…

Question

Options

• AProtected EAP/Microsoft CHAP v2 with user authentication
• BEAP-TLS with machine authentication
• CEAP-TLS with user authentication
• DProtected EAP/Microsoft CHAP v2 with Machine authentication

• A
  12% (5)
• B
  81% (35)
• C
  2% (1)
• D
  5% (2)

Explanation

EAP-TLS with machine authentication satisfies all three requirements simultaneously: it authenticates the device using a certificate issued only to domain-joined corporate machines (blocking personal devices that lack such a cert), and EAP-TLS requires both the client and the RADIUS/authentication server to present certificates, fulfilling the mutual authentication requirement.

Why the distractors fail:

• A (PEAP/MS-CHAPv2 + user auth): Authenticates the user, not the machine - a user could connect from a personal device with their credentials. MS-CHAPv2 is also password-based on the client side, so authentication is not truly mutual (only the server uses a certificate).
• C (EAP-TLS + user auth): EAP-TLS does provide mutual authentication, but user certificates authenticate the person, not the device - a personal device with a user cert installed could still gain access.
• D (PEAP/MS-CHAPv2 + machine auth): Machine authentication restricts to domain-joined devices, but PEAP/MS-CHAPv2 uses a password-based challenge on the client side - the server has a cert, but the client does not, so mutual authentication is not achieved.

Memory tip: Map the requirements to the protocol parts - "mutual authentication" locks you into EAP-TLS (certs on both sides), and "corporate devices only, no personal" locks you into machine authentication (only domain-joined machines get machine certs from AD). Both constraints together → B.

No community discussion yet for this question.