CAS-001 · Question #300
A new company requirement mandates the implementation of multi-factor authentication to access network resources. The security administrator was asked to research and implement the most…
The correct answer is D. Issue individual private/public key pairs to each user, install the public key on the central authentication. In PKI, the correct and secure model is: the user (or device) holds the private key, and the public key is registered on the authentication server (or in a certificate authority-signed certificate). Authentication works because the user proves possession of the private key…
Question
A new company requirement mandates the implementation of multi-factor authentication to access network resources. The security administrator was asked to research and implement the most cost-effective solution that would allow for the authentication of both hardware and users. The company wants to leverage the PKI infrastructure which is already well established. Which of the following solutions should the security administrator implement?
Options
- AIssue individual private/public key pairs to each user, install the private key on the central authentication
- BDeploy USB fingerprint scanners on all desktops, and enable the fingerprint scanner on all laptops.
- CIssue each user one hardware token.
- DIssue individual private/public key pairs to each user, install the public key on the central authentication
How the community answered
(37 responses)- A8% (3)
- B3% (1)
- C16% (6)
- D73% (27)
Explanation
In PKI, the correct and secure model is: the user (or device) holds the private key, and the public key is registered on the authentication server (or in a certificate authority-signed certificate). Authentication works because the user proves possession of the private key without ever exposing it. This leverages the existing PKI infrastructure at minimal incremental cost, supports issuing separate certificates for users and devices (enabling both user and hardware authentication), and satisfies the MFA requirement by combining something you have (the certificate/private key) with something you know (a PIN to unlock it). Option A is fundamentally insecure and wrong - private keys must never be placed on a central server; doing so would allow the server administrator to impersonate any user. Options B and C (biometrics and hardware tokens) do not leverage the existing PKI infrastructure and add unnecessary cost.
Topics
Community Discussion
No community discussion yet for this question.