nerdexam
CompTIA

CAS-003 · Question #326

A security administrator wants to implement two-factor authentication for network switches and routers. The solution should integrate with the company's RADIUS server, which is used for…

The correct answer is B. Configure the RADIUS server to accept the second factor appended to the password. Network. Legacy network devices support only a single password input field, so the HOTP token must be appended to the static password and RADIUS must be configured to parse both factors from that single combined string.

Technical Integration of Enterprise Security

Question

A security administrator wants to implement two-factor authentication for network switches and routers. The solution should integrate with the company's RADIUS server, which is used for authentication to the network infrastructure devices. The security administrator implements the following:

  • An HOTP service is installed on the RADIUS server.
  • The RADIUS server is configured to require the HOTP service for

authentication. The configuration is successfully tested using a software supplicant and enforced across all network devices. Network administrators report they are unable to log onto the network devices because they are not being prompted for the second factor. Which of the following should be implemented to BEST resolve the issue?

Options

  • AReplace the password requirement with the second factor. Network administrators will enter their
  • BConfigure the RADIUS server to accept the second factor appended to the password. Network
  • CReconfigure network devices to prompt for username, password, and a token. Network
  • DInstall a TOTP service on the RADIUS server in addition to the HOTP service. Use the HOTP on

How the community answered

(30 responses)
  • A
    3% (1)
  • B
    83% (25)
  • C
    3% (1)
  • D
    10% (3)

Why each option

Legacy network devices support only a single password input field, so the HOTP token must be appended to the static password and RADIUS must be configured to parse both factors from that single combined string.

AReplace the password requirement with the second factor. Network administrators will enter their

Replacing the static password with only the HOTP token eliminates the knowledge factor entirely, reducing the authentication scheme to single-factor and degrading overall security posture.

BConfigure the RADIUS server to accept the second factor appended to the password. NetworkCorrect

Most routers and switches use RADIUS clients that present only one password prompt to the user; configuring the RADIUS server to accept the OTP appended directly to the static password (for example, 'MyPassword123456') allows the server to split the combined string and independently validate the static password against the directory and the HOTP token against the OTP service - enabling two-factor authentication without requiring changes to network device firmware.

CReconfigure network devices to prompt for username, password, and a token. Network

Reconfiguring network devices to present a separate third prompt for a token requires firmware-level support for extended RADIUS authentication challenges that most legacy infrastructure devices do not implement.

DInstall a TOTP service on the RADIUS server in addition to the HOTP service. Use the HOTP on

Installing a TOTP service alongside HOTP adds a second OTP mechanism but does not address the root cause - that network devices are not displaying a second-factor prompt - so administrators would still not be challenged for the token.

Concept tested: RADIUS HOTP token appended to password for infrastructure MFA

Source: https://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4-2/user/guide/CSACSWug/ch11.html

Topics

#RADIUS#HOTP#multi-factor authentication#network authentication

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-003 Practice