nerdexam
CompTIA

CAS-002 · Question #190

A new company requirement mandates the implementation of multi-factor authentication to access network resources. The security administrator was asked to research and implement the most…

The correct answer is D. Issue individual private/public key pairs to each user, install the public key on the central. PKI-based MFA requires the user's private key to remain on their device while the public key is registered on the central server for both user and hardware authentication.

Enterprise Security

Question

A new company requirement mandates the implementation of multi-factor authentication to access network resources. The security administrator was asked to research and implement the most cost-effective solution that would allow for the authentication of both hardware and users. The company wants to leverage the PKI infrastructure which is already well established. Which of the following solutions should the security administrator implement?

Options

  • AIssue individual private/public key pairs to each user, install the private key on the central
  • BDeploy USB fingerprint scanners on all desktops, and enable the fingerprint scanner on all
  • CIssue each user one hardware token.
  • DIssue individual private/public key pairs to each user, install the public key on the central

How the community answered

(31 responses)
  • A
    10% (3)
  • B
    6% (2)
  • C
    3% (1)
  • D
    81% (25)

Why each option

PKI-based MFA requires the user's private key to remain on their device while the public key is registered on the central server for both user and hardware authentication.

AIssue individual private/public key pairs to each user, install the private key on the central

Installing the private key on a central server would expose it to all users and administrators, fundamentally destroying the PKI security model where private keys must never leave the owner's control.

BDeploy USB fingerprint scanners on all desktops, and enable the fingerprint scanner on all

USB fingerprint scanners use biometrics rather than PKI, so they do not leverage the company's existing PKI infrastructure and would require entirely new investment.

CIssue each user one hardware token.

Hardware OTP tokens authenticate the user but do not leverage PKI or authenticate the hardware device itself, failing to meet both stated requirements.

DIssue individual private/public key pairs to each user, install the public key on the centralCorrect

In PKI authentication, the private key is held by the user on a smart card or local key store, while the public key is installed on the central authentication server to verify digital signatures. This setup authenticates both the user (via possession of the private key) and the hardware (the device or smart card holding it), fulfilling the MFA requirement while leveraging existing PKI infrastructure.

Concept tested: PKI-based multi-factor authentication key placement

Source: https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final

Topics

#multi-factor authentication#PKI#smart card#public key infrastructure

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice