nerdexam
GIAC

GPEN · Question #299

You work as a Network Administrator for McNeil Inc. The company has a Windows Active Directory-based single domain single forest network. The functional level of the forest is Windows Server 2003. The

The correct answer is A. The wireless network communication will be secured.. PEAP-MS-CHAP v2 authenticates using username and password credentials, not smart cards. Only the wireless security task is accomplished; smart card authentication requires EAP-TLS.

Penetration Testing Foundations & Reconnaissance

Question

You work as a Network Administrator for McNeil Inc. The company has a Windows Active Directory-based single domain single forest network. The functional level of the forest is Windows Server 2003. The company's management has decided to provide laptops to its sales team members. These laptops are equipped with smart card readers. The laptops will be configured as wireless network clients. You are required to accomplish the following tasks:

The wireless network communication should be secured. The laptop users should be able to use smart cards for getting authenticated. In order to accomplish the tasks, you take the following steps:

Configure 802.1x and WEP for the wireless connections. Configure the PEAP-MS-CHAP v2 protocol for authentication. What will happen after you have taken these steps?

Options

  • AThe wireless network communication will be secured.
  • BThe laptop users will be able to use smart cards for getting authenticated.
  • CBoth tasks will be accomplished.
  • DNone of the tasks will be accomplished

How the community answered

(35 responses)
  • A
    80% (28)
  • B
    3% (1)
  • C
    11% (4)
  • D
    6% (2)

Why each option

PEAP-MS-CHAP v2 authenticates using username and password credentials, not smart cards. Only the wireless security task is accomplished; smart card authentication requires EAP-TLS.

AThe wireless network communication will be secured.Correct

Configuring 802.1x with WEP does provide a layer of wireless security by requiring port-based network access control before traffic is allowed, so the wireless communication security task is fulfilled. However, PEAP-MS-CHAP v2 relies on a username and password exchange inside a TLS tunnel and does not support certificate-based smart card credentials - smart card authentication requires EAP-TLS, which uses client certificates stored on the card.

BThe laptop users will be able to use smart cards for getting authenticated.

PEAP-MS-CHAP v2 only supports username/password authentication and cannot leverage smart card certificates; EAP-TLS would be the required protocol to enable smart card logon.

CBoth tasks will be accomplished.

Both tasks are not accomplished because smart card authentication is not supported by the PEAP-MS-CHAP v2 configuration chosen.

DNone of the tasks will be accomplished

Wireless communication security is accomplished via 802.1x and WEP, so it is incorrect to say neither task was accomplished.

Concept tested: EAP method selection for smart card wireless authentication

Source: https://learn.microsoft.com/en-us/windows-server/networking/technologies/extensible-authentication-protocol/network-access

Topics

#EAP-TLS#smart card authentication#802.1X#wireless security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GPEN Practice