FCSS_LED_AR-7.6 · Question #15
An LDAP server has been successfully configured on FortiGate, which forwards authentication requests to a Windows Active Directory (AD) server. Users can authenticate using PAP, but authentication…
The correct answer is A. PAP sends passwords in cleartext. PAP (Password Authentication Protocol) transmits the user's password in cleartext without encryption, making it vulnerable to interception and eavesdropping attacks on the network. MSCHAPv2 (Microsoft Challenge Handshake Authentication Protocol version 2) uses a…
Question
An LDAP server has been successfully configured on FortiGate, which forwards authentication requests to a Windows Active Directory (AD) server. Users can authenticate using PAP, but authentication fails with MSCHAPv2. Why is it not recommended to use PAP for authentication?
Options
- APAP sends passwords in cleartext.
- BPAP requires the use of an insecure port that is easily blocked by firewalls.
- CPAP does not support domain-based authentication for Active Directory.
- DPAP is only supported for local user accounts, not external authentication sources.
How the community answered
(43 responses)- A88% (38)
- B7% (3)
- C2% (1)
- D2% (1)
Explanation
PAP (Password Authentication Protocol) transmits the user's password in cleartext without encryption, making it vulnerable to interception and eavesdropping attacks on the network. MSCHAPv2 (Microsoft Challenge Handshake Authentication Protocol version 2) uses a challenge-response mechanism where the password is hashed and never sent directly, providing stronger security. PAP's lack of encryption is why many administrators avoid it for authentication, especially when dealing with Active Directory or other secure identity sources.
Topics
Community Discussion
No community discussion yet for this question.