In an enterprise deployment, a network security engineer wants to assign rights to a group of administrators without creating local administrator accounts on the firewall. Which authentication…

The correct answer is C. Certificate-based authentication. Certificate-based authentication (using a PKI/client certificate infrastructure) allows an enterprise to authenticate administrator accounts against certificates issued by a trusted CA without creating individual local accounts on the firewall. Admin role profiles can be mapped…

Submitted by kavita_s· Apr 18, 2026Deploy and Configure

Question

In an enterprise deployment, a network security engineer wants to assign rights to a group of administrators without creating local administrator accounts on the firewall. Which authentication method must be used?

Options

AKerberos
BRADlUS with Vendor-Specific Attributes
CCertificate-based authentication
DLDAP

How the community answered

(29 responses)

A
3% (1)
B
14% (4)
C
79% (23)
D
3% (1)

Explanation

Certificate-based authentication (using a PKI/client certificate infrastructure) allows an enterprise to authenticate administrator accounts against certificates issued by a trusted CA without creating individual local accounts on the firewall. Admin role profiles can be mapped to certificate attributes (such as the Subject or OID fields), enabling group-level rights assignment to all holders of certificates with the appropriate attributes. LDAP and Kerberos can authenticate users but typically still require local admin account entries for role mapping. RADIUS with VSA can also carry role information, but certificate-based auth is the method that most directly supports group-level assignment without local accounts in a certificate-managed enterprise.

Topics

#Administrator Authentication#External Authentication#Role-Based Access Control (RBAC)#Certificate-based Authentication

Community Discussion

No community discussion yet for this question.

Full PCNSE Practice