nerdexam
GIAC

GPEN · Question #29

The employees of CCN Inc. require remote access to the company's proxy servers. In order to provide solid wireless security, the company uses LEAP as the authentication protocol. Which of the followin

The correct answer is A. Password hash for client authentication C. Dynamic key encryption. LEAP (Lightweight Extensible Authentication Protocol) is a Cisco proprietary 802.1X protocol that uses MS-CHAPv2-based password hashing for client authentication and supports dynamic WEP key encryption, but does not use certificates or provide the strongest security.

Penetration Testing Foundations & Reconnaissance

Question

The employees of CCN Inc. require remote access to the company's proxy servers. In order to provide solid wireless security, the company uses LEAP as the authentication protocol. Which of the following is supported by the LEAP protocol? Each correct answer represents a complete solution. Choose all that apply.

Options

  • APassword hash for client authentication
  • BStrongest security level
  • CDynamic key encryption
  • DPublic key certificate for server authentication

How the community answered

(46 responses)
  • A
    78% (36)
  • B
    9% (4)
  • D
    13% (6)

Why each option

LEAP (Lightweight Extensible Authentication Protocol) is a Cisco proprietary 802.1X protocol that uses MS-CHAPv2-based password hashing for client authentication and supports dynamic WEP key encryption, but does not use certificates or provide the strongest security.

APassword hash for client authenticationCorrect

LEAP authenticates clients using a password hash mechanism derived from MS-CHAPv2, where the client proves knowledge of the password by responding to a challenge with a hashed value, enabling mutual authentication without certificates.

BStrongest security level

LEAP is not the strongest security level - it has well-documented vulnerabilities to offline dictionary attacks (exploited by tools like ASLEAP), making protocols like EAP-TLS or PEAP significantly more secure.

CDynamic key encryptionCorrect

LEAP supports dynamic per-session WEP key generation, meaning encryption keys are rotated during the session rather than using a static shared key, which improves over basic static WEP deployments.

DPublic key certificate for server authentication

LEAP does not use public key certificates for server authentication; certificate-based server authentication is a feature of EAP-TLS and PEAP, not LEAP.

Concept tested: LEAP protocol authentication and encryption features

Source: https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/44021-leap.html

Topics

#LEAP protocol#wireless authentication#dynamic key encryption#WPA security

Community Discussion

No community discussion yet for this question.

Full GPEN Practice