Which of the following descriptions of message authentication methods in IS-IS are correct? (Multiple choice)

Question

Options

• AMD5 authentication can perform the MD5 algorithm on the configured password and then add it to the message, which improves the security of the password.
• BIS-IS carries authentication information in form of TLV and the type of authentication TLV is 2
• CPlaintext authentication adds the password directly to the message, which has very low security
• DKeychain authentication enables the password list that changes over time to further improve network security

• A
  79% (22)
• B
  21% (6)

Explanation

A, C, and D each correctly describe a distinct IS-IS authentication method. MD5 authentication (A) hashes the configured password before embedding it in the PDU, ensuring the raw password is never exposed on the wire. Plaintext authentication (C) does the opposite - it inserts the password as cleartext, making it trivially readable via packet capture. Keychain authentication (D) supports a rotating list of time-valid keys, so credentials change automatically over time without manual reconfiguration, raising the bar for replay or credential-theft attacks.

Option B is wrong because the IS-IS authentication TLV type is 10, not 2. TLV type 2 is actually used for IS Neighbors in IS-IS Hello PDUs - a completely different purpose. Mixing up TLV numbers is a classic exam trap.

Memory tip: Think "PAM-K" - Plaintext (weak), Authentication via MD5 (hashed), Keychain (rotating). For the TLV number, remember "auth10" - authentication TLV = 10, and any other number in an answer choice for auth is a red flag.

No community discussion yet for this question.