Which of the following statements are true about MS-CHAPv2? Each correct answer represents a complete solution. Choose all that apply.

EAP-TLS can be configured as the inner authentication method for PPTP tunnels as a stronger, certificate-based alternative to MS-CHAPv2, providing mutual authentication without reliance on password hashes.

MS-CHAPv2 defines an authenticator-controlled password change mechanism using the ChangePasswordV2 packet, allowing the server to force a password change during the authentication exchange.

Because MS-CHAPv2 relies on NT hashes in its challenge-response exchange, a captured handshake can be subjected to offline brute-force or dictionary attacks to recover the plaintext password without further network interaction.

MS-CHAPv2 is a connection-oriented challenge-response authentication protocol operating over PPP, which is inherently connection-based, not connectionless.