GPEN · Question #339
Mark works as a Network Administrator for NetTech Inc. The company has a Windows 2003 Active Directory domain-based network. The domain consists of a domain controller, two Windows 2003 member servers
The correct answer is C. Use PEAP. PEAP is the optimal choice for protecting username/password-based 802.1x authentication on a wireless network because it establishes an encrypted TLS tunnel without requiring client-side certificates.
Question
Mark works as a Network Administrator for NetTech Inc. The company has a Windows 2003 Active Directory domain-based network. The domain consists of a domain controller, two Windows 2003 member servers, and one hundred client computers. The company employees use laptops with Windows XP Professional. These laptops are equipped with wireless network cards that are used to connect to access points located in the Marketing department of the company. The company employees log on to the domain by using a user name and password combination. The wireless network has been configured with WEP in addition to 802.1x. Mark wants to provide the best level of security for the kind of authentication used by the company. What will Mark do to accomplish the task?
Options
- AUse EAP-TLS
- BUse MD5
- CUse PEAP
- DUse IPSec
How the community answered
(30 responses)- A3% (1)
- B10% (3)
- C83% (25)
- D3% (1)
Why each option
PEAP is the optimal choice for protecting username/password-based 802.1x authentication on a wireless network because it establishes an encrypted TLS tunnel without requiring client-side certificates.
EAP-TLS provides mutual certificate-based authentication, requiring both a server and a client certificate per device - this infrastructure does not exist here since employees authenticate with usernames and passwords only.
MD5 (as in EAP-MD5) does not support mutual authentication or protect against offline dictionary attacks, making it insecure for wireless 802.1x deployments and unsuitable as a security improvement.
PEAP wraps EAP authentication inside a server-authenticated TLS tunnel, shielding credentials from eavesdropping over the wireless medium. It requires only a server certificate, making it directly compatible with the company's existing username/password authentication model without requiring a public key infrastructure for every client.
IPSec operates at the network layer to encrypt IP traffic in transit, but it does not function as an 802.1x authentication method and cannot replace or improve the wireless authentication mechanism itself.
Concept tested: 802.1x wireless authentication with PEAP and TLS tunnel
Source: https://learn.microsoft.com/en-us/windows-server/networking/technologies/extensible-authentication-protocol/network-access
Topics
Community Discussion
No community discussion yet for this question.