The network architecture of an enterprise is as shown in the figure below. Portal authentication is deployed on SW2. Its authentication-free template is as shown in the figure. Which of the…

Question

Exhibit

Options

• AAt this time, the terminal can open the authentication interface.
• BAt this time, the terminal can ping its own gateway.
• CAt this time, the terminal can perform DNS resolution normally.
• DAt this time, the terminal can be redirected to the authentication interface by entering the URL in

• A
  15% (5)
• B
  74% (25)
• C
  3% (1)
• D
  9% (3)

Explanation

Option B is correct because Portal authentication requires that the terminal have basic Layer 3 connectivity to the local network before authentication begins. The gateway (SW2) is always reachable even in the pre-authentication state - without this, the authentication system itself could not function. Pinging the gateway only requires an ICMP exchange at the local network level, which is never blocked by authentication-free templates.

Why the distractors are wrong:

• A (open authentication interface): Directly opening the Portal page requires the terminal to already know and reach the Portal server's address. If the Portal server's IP is not explicitly listed in the authentication-free template, direct access is blocked - and without DNS (see C), even a hostname can't be resolved.
• C (DNS resolution): DNS works only if the DNS server's IP is included in the authentication-free (pre-auth) resource list. The typical authentication-free template does not whitelist external DNS servers, so DNS queries are dropped before login.
• D (redirect via URL entry): HTTP redirect depends on the terminal successfully resolving a domain name via DNS first. Since DNS is unavailable (as established for C), the URL can't be resolved, and the redirect mechanism never triggers. HTTPS URLs compound this further, as they cannot be intercepted for redirect.

Memory tip: Think of pre-authentication access like being in a lobby - you can knock on the front door (ping the gateway), but you can't call anyone inside (DNS), visit specific rooms (Portal server), or have the receptionist guide you (redirect) until DNS is available to facilitate communication.

No community discussion yet for this question.