In 802.1X authentication, in order to support the EAP relay mode, the RADIUS protocol adds some new attributes. Which of the following RADIUS attributes is used to encapsulate EAP messages?

Question

Options

• ANAS-Identifier
• BMessage-Authenticator
• CNAS-Message
• DEAP-Message

• A
  14% (5)
• B
  5% (2)
• C
  3% (1)
• D
  78% (29)

Explanation

EAP-Message (D) is the RADIUS attribute specifically designed to carry EAP packets between the NAS (Network Access Server) and the RADIUS server during 802.1X relay mode - it's the tunnel through which raw EAP data travels, enabling RADIUS to act as a pass-through for EAP without interpreting the authentication method itself.

Why the distractors are wrong:

• A. NAS-Identifier identifies the NAS device sending the request (a hostname or string label) - it has nothing to do with EAP payload transport.
• B. Message-Authenticator is an HMAC-MD5 integrity check attribute that protects RADIUS packets from tampering - it secures the message but doesn't encapsulate EAP data.
• C. NAS-Message is not a standard RADIUS attribute; it's a fabricated distractor with no role in the EAP relay process.

Memory tip: The attribute name maps directly to its function - "EAP-Message" carries the EAP message. In 802.1X relay mode, think of it as a labeled envelope: the outer envelope is RADIUS, and the EAP-Message attribute is the inner letter stuffed inside it.

No community discussion yet for this question.