RADIUS supports the use of PAP and CHAP methods to verify user identity information. Which of the following descriptions of the CHAP method are correct? (Multiple choice)

Question

Options

• AThe password is transmitted in clear text between the authentication terminal and the network
• BCompared with PAP authentication method, CHAP authentication method has better
• CDuring the authentication process, the NAS device transmits the user name, encrypted password,
• DThe password is transmitted in cipher text between the authentication terminal and the network

• A
  23% (5)
• B
  77% (17)

Explanation

CHAP (Challenge Handshake Authentication Protocol) uses a three-way challenge-response handshake where the NAS sends a random challenge, the client hashes it together with the password using MD5, and only that hash - never the raw password - travels over the network. This makes options B, C, and D correct: CHAP is demonstrably more secure than PAP (B), the NAS transmits the username alongside the MD5-encrypted password during authentication (C), and the password is indeed protected via ciphertext/hashing rather than sent in the clear (D).

Option A is wrong because it describes PAP, not CHAP - PAP is the vulnerable protocol that sends credentials in plaintext, which is exactly the weakness CHAP was designed to fix.

Memory tip: Think of CHAP as a challenge to the attacker - the server issues a "challenge," the client responds with a hash, and the real password never leaves the client machine. If you remember "CHAP = Challenge + Hash, PAP = Plain And Plaintext," you'll never confuse the two on an exam.

No community discussion yet for this question.