Pete, a security auditor, has detected clear text passwords between the RADIUS server and the authenticator. Which of the following is configured in the RADIUS server and what technologies should…

The correct answer is A. PAP, MSCHAPv2. PAP (Password Authentication Protocol) sends credentials in cleartext (or with only trivial obfuscation), which is why Pete can see the passwords on the wire. RADIUS uses a shared secret to obscure PAP passwords, but this is considered weak. The fix is to switch to MSCHAPv2…

Security architecture

Question

Pete, a security auditor, has detected clear text passwords between the RADIUS server and the authenticator. Which of the following is configured in the RADIUS server and what technologies should the authentication protocol be changed to?

Options

APAP, MSCHAPv2
BCHAP, PAP
CMSCHAPv2, NTLMv2
DNTLM, NTLMv2

How the community answered

(52 responses)

A
81% (42)
B
2% (1)
C
12% (6)
D
6% (3)

Explanation

PAP (Password Authentication Protocol) sends credentials in cleartext (or with only trivial obfuscation), which is why Pete can see the passwords on the wire. RADIUS uses a shared secret to obscure PAP passwords, but this is considered weak. The fix is to switch to MSCHAPv2 (Microsoft Challenge Handshake Authentication Protocol v2), which uses a challenge-response mechanism and never transmits the password in cleartext, providing mutual authentication and encrypted credentials. CHAP (B) sends a challenge hash but is still considered weaker than MSCHAPv2. NTLMv2 (C, D) is a Windows authentication protocol not directly substituted into RADIUS this way.

Topics

#RADIUS#PAP#MSCHAPv2#authentication protocols

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice