The exhibit shows the 802.1X-related settings for Windows domain clients. What should admins change to make the settings follow best security practices?

Question

Exhibit

Options

• ASpecify at least two server names under the "Connect to these servers" field.
• BSelect the desired Trusted Root Certificate Authority and select the check box next to "Don't
• CUnder the "Connect to these servers" field, use a wildcard in the server name.
• DClear the check box for using simple certificate selection and select the desired certificate

• A
  75% (15)
• B
  10% (2)
• D
  15% (3)

Explanation

Specifying at least two RADIUS server names in the "Connect to these servers" field is the recommended best practice because it ensures both server validation (clients verify they're connecting to a legitimate RADIUS server, not a rogue one) and redundancy (failover if one server is unavailable). Leaving this field empty means any server presenting a certificate from a trusted CA could authenticate the client, creating a man-in-the-middle vulnerability.

Why the distractors are wrong:

• B is partially correct (selecting a Trusted Root CA is good practice), but the truncated option likely pairs it with a setting that creates a different risk or is redundant with what specifying server names already accomplishes.
• C is the opposite of best practice - using wildcards in the server name field broadens trust too much, potentially allowing any server whose name matches the pattern to be accepted, defeating the purpose of server validation.
• D addresses client certificate selection behavior, which is a separate concern unrelated to securing the server validation process that this question focuses on.

Memory tip: Think of the "Connect to these servers" field like a VIP list at a door - a specific list of two or more names gives you both security (only those servers get in) and a backup (if one bouncer is out, the other covers). Wildcards are like saying "anyone whose name starts with 'R'" - too loose to be secure.

No community discussion yet for this question.