nerdexam
CompTIA

CAS-002 · Question #326

An industry organization has implemented a system to allow trusted authentication between all of its partners. The system consists of a web of trusted RADIUS servers communicating over the Internet…

The correct answer is C. Enforce TLS connections between RADIUS servers. Enforcing TLS between RADIUS servers provides mutual certificate-based authentication and channel encryption, directly preventing man-in-the-middle attacks over untrusted networks.

Technical Integration of Enterprise Components

Question

An industry organization has implemented a system to allow trusted authentication between all of its partners. The system consists of a web of trusted RADIUS servers communicating over the Internet. An attacker was able to set up a malicious server and conduct a successful man-in-the-middle attack. Which of the following controls should be implemented to mitigate the attack in the future?

Options

  • AUse PAP for secondary authentication on each RADIUS server
  • BDisable unused EAP methods on each RADIUS server
  • CEnforce TLS connections between RADIUS servers
  • DUse a shared secret for each pair of RADIUS servers

How the community answered

(43 responses)
  • A
    5% (2)
  • B
    16% (7)
  • C
    72% (31)
  • D
    7% (3)

Why each option

Enforcing TLS between RADIUS servers provides mutual certificate-based authentication and channel encryption, directly preventing man-in-the-middle attacks over untrusted networks.

AUse PAP for secondary authentication on each RADIUS server

PAP transmits passwords in cleartext, which would make the communication even more vulnerable to interception by a MITM attacker rather than mitigating the threat.

BDisable unused EAP methods on each RADIUS server

Disabling unused EAP methods reduces the authentication attack surface but does not protect the RADIUS transport channel from interception or impersonation by a rogue server.

CEnforce TLS connections between RADIUS serversCorrect

TLS requires each RADIUS server to present a valid certificate, allowing peers to cryptographically verify server identity before exchanging any authentication data. This eliminates the attacker's ability to impersonate a trusted RADIUS server and intercept credentials, which is the exact mechanism exploited in the described MITM attack.

DUse a shared secret for each pair of RADIUS servers

Shared secrets provide rudimentary hop-by-hop authentication between RADIUS peers but do not encrypt the channel or provide certificate-based identity verification, leaving the connection susceptible to interception.

Concept tested: RADIUS mutual authentication and encryption using TLS (RADSEC)

Source: https://datatracker.ietf.org/doc/html/rfc6614

Topics

#RADIUS#man-in-the-middle attack#TLS enforcement#authentication protocols

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice