nerdexam
CompTIA

CAS-002 · Question #783

A company is deploying a new iSCSI-based SAN. The requirements are as follows: - SAN nodes must authenticate each other. - Shared keys must NOT be used. - Do NOT use encryption in order to gain…

The correct answer is B. IPSec using AH with PKI certificates for authentication D. Initiators and targets use CHAP authentication. IPSec AH with PKI provides certificate-based mutual authentication without encryption, and mutual CHAP satisfies the requirement for both iSCSI initiators and targets to authenticate each other.

Technical Integration of Enterprise Components

Question

A company is deploying a new iSCSI-based SAN. The requirements are as follows:

  • SAN nodes must authenticate each other.
  • Shared keys must NOT be used.
  • Do NOT use encryption in order to gain performance.

Which of the following design specifications meet all the requirements? (Select TWO).

Options

  • ATargets use CHAP authentication
  • BIPSec using AH with PKI certificates for authentication
  • CFiber channel should be used with AES
  • DInitiators and targets use CHAP authentication
  • EFiber channel over Ethernet should be used
  • FIPSec using AH with PSK authentication and 3DES
  • GTargets have SCSI IDs for authentication

How the community answered

(55 responses)
  • A
    24% (13)
  • B
    58% (32)
  • C
    4% (2)
  • E
    9% (5)
  • F
    4% (2)
  • G
    2% (1)

Why each option

IPSec AH with PKI provides certificate-based mutual authentication without encryption, and mutual CHAP satisfies the requirement for both iSCSI initiators and targets to authenticate each other.

ATargets use CHAP authentication

Configuring CHAP only on targets provides one-directional authentication - targets do not authenticate initiators - which fails the mutual authentication requirement.

BIPSec using AH with PKI certificates for authenticationCorrect

IPSec Authentication Header (AH) provides data integrity and origin authentication without encrypting the payload, satisfying the no-encryption performance requirement. PKI certificates enable asymmetric public-key authentication, eliminating the need for pre-shared keys (PSK) while still providing strong, verifiable identity for both parties.

CFiber channel should be used with AES

Fibre Channel is a separate storage fabric protocol, not iSCSI-based, and AES encryption directly violates the no-encryption requirement.

DInitiators and targets use CHAP authenticationCorrect

Configuring CHAP on both initiators and targets enables mutual authentication - each side issues a challenge and verifies the other's response - satisfying the requirement that nodes authenticate each other. CHAP uses a hashed challenge-response mechanism (not a cryptographic session key) and adds no encryption overhead.

EFiber channel over Ethernet should be used

Fibre Channel over Ethernet (FCoE) is not an iSCSI solution and does not address the iSCSI-specific authentication requirements stated.

FIPSec using AH with PSK authentication and 3DES

IPSec with PSK (pre-shared key) authentication explicitly uses a shared key, which violates the requirement that shared keys must not be used.

GTargets have SCSI IDs for authentication

SCSI IDs are device identifiers used for addressing, not an authentication mechanism, and provide no cryptographic proof of identity.

Concept tested: iSCSI mutual authentication with IPSec AH and CHAP

Source: https://www.rfc-editor.org/rfc/rfc3720

Topics

#iSCSI SAN#CHAP authentication#IPSec AH#PKI certificates

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice