CAS-002 · Question #339
Two universities are making their 802.11n wireless networks available to the other university's students. The infrastructure will pass the student's credentials back to the home school for…
The correct answer is A. The transport layer between the RADIUS servers should be secured. RADIUS traffic between proxy servers traversing the Internet must be secured at the transport layer because the base RADIUS protocol does not adequately protect data in transit over untrusted public networks.
Question
Two universities are making their 802.11n wireless networks available to the other university's students. The infrastructure will pass the student's credentials back to the home school for authentication via the Internet. The requirements are:
- Mutual authentication of clients and authentication server
- The design should not limit connection speeds
- Authentication must be delegated to the home school
- No passwords should be sent unencrypted
The following design was implemented:
- WPA2 Enterprise using EAP-PEAP-MSCHAPv2 will be used for wireless
security
- RADIUS proxy servers will be used to forward authentication requests
to the home school
- The RADIUS servers will have certificates from a common public
certificate authority
- A strong shared secret will be used for RADIUS server authentication
Which of the following security considerations should be added to the design?
Options
- AThe transport layer between the RADIUS servers should be secured
- BWPA Enterprise should be used to decrease the network overhead
- CThe RADIUS servers should have local accounts for the visiting students
- DStudents should be given certificates to use for authentication to the network
How the community answered
(28 responses)- A54% (15)
- B25% (7)
- C14% (4)
- D7% (2)
Why each option
RADIUS traffic between proxy servers traversing the Internet must be secured at the transport layer because the base RADIUS protocol does not adequately protect data in transit over untrusted public networks.
RADIUS uses UDP and encrypts only the user password field in Access-Request packets, leaving other attributes and metadata exposed to interception. When RADIUS proxy servers communicate over the Internet between two universities, a transport-layer security mechanism such as RadSec (RADIUS over TLS, RFC 6614) or an IPsec tunnel is required to protect all traffic. Without this, the shared secret alone is insufficient to prevent interception and tampering on an untrusted public network, violating the requirement that no passwords be sent unencrypted.
Downgrading from WPA2 to WPA (WPA1/TKIP) would reduce security strength and potentially limit throughput, violating both the speed and security requirements stated in the design.
Creating local accounts on RADIUS servers for visiting students contradicts the explicit requirement to delegate authentication back to the home school and would introduce unmanageable credential sprawl.
Issuing certificates to students for client authentication would require significant PKI infrastructure not mandated by the requirements, and EAP-PEAP already provides mutual authentication using server-side certificates without requiring client certificates.
Concept tested: RADIUS proxy transport security over untrusted networks
Source: https://www.rfc-editor.org/rfc/rfc6614
Topics
Community Discussion
No community discussion yet for this question.