GSLC · Question #460
Mark works as a Network Administrator for Infonet Inc. The company has a Windows 2003 domainbased network. The network contains five Windows 2003 member servers and 300 Windows XP Professional…
The correct answer is A. Protected EAP (PEAP). PEAP provides an encrypted TLS tunnel for 802.1x authentication without requiring client-side certificates, and natively supports fast reconnect via cached session keys.
Question
Mark works as a Network Administrator for Infonet Inc. The company has a Windows 2003 domainbased network. The network contains five Windows 2003 member servers and 300 Windows XP Professional client computers. Mark is setting up a wireless network for the company. He is planning to implement 802.1x authentication for this new wireless network. Mark is not planning to use a public key infrastructure (PKI) and certificates for authentication. Mark also wants an encrypted authentication channel and a fast reconnect using cached session keys. Which of the following authentication methods will he use to accomplish the task?
Options
- AProtected EAP (PEAP)
- BEAP-Transport Layer Security (EAP-TLS)
- CShared Key authentication
- DDigest authentication
How the community answered
(33 responses)- A79% (26)
- B3% (1)
- C12% (4)
- D6% (2)
Why each option
PEAP provides an encrypted TLS tunnel for 802.1x authentication without requiring client-side certificates, and natively supports fast reconnect via cached session keys.
Protected EAP (PEAP) creates an encrypted TLS tunnel using only a server-side certificate, so no client PKI infrastructure is required. Within the tunnel it carries inner authentication methods such as MS-CHAPv2, satisfying the encrypted channel requirement. PEAP also supports fast reconnect by caching session keys, which reduces re-authentication time for roaming clients - meeting all stated requirements.
EAP-TLS requires both a server certificate and a client certificate issued by a PKI, which directly conflicts with the stated requirement to avoid PKI and certificates.
Shared Key authentication is a basic WEP-era method that does not use 802.1x or provide an encrypted authentication channel, and offers no fast reconnect capability.
Digest authentication is an HTTP-based authentication mechanism and is not a valid 802.1x EAP method for wireless network authentication.
Concept tested: PEAP 802.1x wireless authentication without client certificates
Source: https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-np-configure
Topics
Community Discussion
No community discussion yet for this question.