A security engineer is configuring a wireless network that must support mutual authentication of the wireless client and the authentication server before users provide credentials. The wireless networ

EAP-FAST (Flexible Authentication via Secure Tunneling) relies on Protected Access Credentials (PACs) for authentication and secure tunneling, which, while providing mutual authentication, is not the most direct fit for the specific requirement of username and password-based authentication as an inner method like PEAP.

EAP-TLS (Transport Layer Security) performs strong mutual authentication using digital certificates for both the client and the server, rather than supporting authentication with usernames and passwords for the user identity.

PEAP (Protected EAP) first establishes a secure TLS tunnel where the authentication server authenticates itself to the client, fulfilling the mutual authentication requirement before any user credentials are exchanged. Within this protected tunnel, PEAP supports inner EAP methods, such as MSCHAPv2, which allows for username and password-based authentication.

EAP (Extensible Authentication Protocol) is a framework that defines how authentication messages are exchanged, not a specific authentication protocol itself that provides the required features of mutual authentication before credentials and username/password support.