There are two methods for processing MAC authentication user passwords: PAP and CHAP. When using the PAP method, the device arranges the MAC address, shared secret key, and random value in order…

Question

Options

• APAP-Password
• BPAP-Challenge
• CCHAP-Password
• DUser-Password

• A
  3% (2)
• B
  8% (5)
• C
  5% (3)
• D
  84% (52)

Explanation

User-Password is the correct RADIUS attribute because it is the standard RFC 2865 attribute (Attribute 2) that carries the obfuscated password in PAP-based authentication - even when that "password" is a derived value like a MAC address combined with a shared secret and random value, then MD5-hashed. PAP-Password (A) is a plausible-sounding distractor, but no such RADIUS attribute exists; the protocol is called PAP, but the actual attribute holding the credential is generically named User-Password. PAP-Challenge (B) doesn't exist either - challenges belong to CHAP, not PAP (PAP sends credentials directly, it doesn't use a challenge-response handshake). CHAP-Password (C) is a real RADIUS attribute (Attribute 3), but it's used exclusively for CHAP authentication where the MD5 hash incorporates a server-sent challenge, which is a different flow entirely.

Memory tip: Think of it this way - RADIUS was designed before protocol-specific naming was common, so it uses the generic User-Password regardless of whether PAP or another scheme derived that password value. If you see "PAP" in an attribute name on the exam, that's the trap.

No community discussion yet for this question.