The 802.1X authentication system supports two authentication methods, EAP relay and EAP termination. to complete the authentication between the device and the authentication server. Which of the…

Question

Options

• AThe EAP termination method supports three authentication methods: EAP-TLS, EAP-TTLS and EAP-PEAP
• BThe authentication server in EAP relay mode must support EAP
• CThe terminal device and the device-side authentication must support PAP and CHAP authentication, so the server needs to be upgraded
• DThe device-side processing of EAP relay mode is simpler and supports more authentication methods

• A
  74% (17)
• B
  17% (4)
• D
  9% (2)

Explanation

A is wrong because EAP-TLS, EAP-TTLS, and EAP-PEAP are methods used in EAP relay mode, not EAP termination. In EAP termination, the authenticating device (switch) terminates the EAP session itself and converts it to PAP or CHAP before forwarding to the RADIUS server - so no complex EAP methods travel to the server at all.

C is wrong because the terminal device (supplicant/client) communicates using EAP - it does not need to support PAP or CHAP. It is the authenticating device (the switch) that converts EAP into PAP/CHAP toward the RADIUS server. Additionally, EAP termination actually simplifies server requirements - the server does not need upgrading to support EAP; it only needs PAP/CHAP support.

B is correct (a true statement, not a wrong one): in EAP relay mode, the switch is just a transparent forwarder, so the RADIUS server must natively support EAP to handle the full authentication exchange.

D is correct (also a true statement): in EAP relay mode, the switch does minimal processing (just forwarding packets), making device-side logic simpler, while supporting a wider range of EAP authentication methods.

Memory tip: Think of EAP relay as a "mail carrier" - the switch delivers EAP packets unopened, so the server must understand EAP, and more methods are possible. EAP termination is a "translator" - the switch breaks open the EAP session and rewrites it in simple PAP/CHAP, meaning complex EAP methods never reach the server.

No community discussion yet for this question.