ACMA Authentication Methods 2 — Questions and Answers
Question 1: Which EAP method uses a client-side certificate for mutual authentication without requiring a server-side password?
- EAP-PEAP
- EAP-TLS (Correct answer)
- EAP-MD5
- EAP-GTC
Correct answer: EAP-TLS
EAP-TLS requires both the client and server to present X.509 certificates, providing strong mutual authentication without passwords.
Question 2: In Aruba ClearPass, what is the purpose of the 'Authentication Source' configuration?
- Defines which RADIUS server to forward requests to
- Specifies where user credentials are validated, such as AD or LDAP (Correct answer)
- Sets the encryption type for the RADIUS shared secret
- Determines which SSID triggers the authentication policy
Correct answer: Specifies where user credentials are validated, such as AD or LDAP
An Authentication Source in ClearPass defines the backend identity store (e.g., Active Directory, LDAP, or a local database) used to verify user credentials.
Question 3: What is the role of the Authenticator in the 802.1X framework?
- Generates session keys for wireless encryption
- Acts as a middleman forwarding EAP messages between supplicant and authentication server (Correct answer)
- Stores the user credential database
- Issues digital certificates to wireless clients
Correct answer: Acts as a middleman forwarding EAP messages between supplicant and authentication server
The Authenticator (typically a wireless AP or switch) relays EAP messages between the supplicant (client) and the authentication server without inspecting credentials.
Question 4: Which authentication method is considered the weakest for WPA2-Enterprise deployments because it only validates the server, not the client?
- EAP-TLS
- EAP-TTLS
- EAP-PEAP with MSCHAPv2
- EAP-MD5 (Correct answer)
Correct answer: EAP-MD5
EAP-MD5 provides only one-way authentication (server to client is not validated) and sends a challenge-response that is vulnerable to offline dictionary attacks.
Question 5: When configuring MAC Authentication Bypass (MAB) on an Aruba AP, what credential does the device send to the RADIUS server?
- A pre-shared key derived from the device serial number
- The device's MAC address as both username and password (Correct answer)
- An EAP token generated by the AP
- The device hostname and IP address
Correct answer: The device's MAC address as both username and password
In MAB, the AP sends the connecting device's MAC address as the RADIUS username and password, allowing the server to authorize known devices.
Question 6: Which Aruba feature allows different VLANs to be assigned to users based on RADIUS attributes returned after authentication?
- Role Derivation Rules
- RADIUS CoA (Change of Authorization)
- Dynamic VLAN Assignment (Correct answer)
- Captive Portal Redirect
Correct answer: Dynamic VLAN Assignment
Dynamic VLAN Assignment uses RADIUS attributes (such as Tunnel-Private-Group-ID) returned in the Access-Accept message to place clients in specific VLANs.
Question 7: In a ClearPass Policy Manager enforcement policy, what happens when no enforcement profile matches the client's authentication result?
- The client is granted full network access by default
- The client is placed in a quarantine VLAN automatically
- ClearPass applies the default enforcement profile configured in the service (Correct answer)
- The RADIUS request is silently dropped
Correct answer: ClearPass applies the default enforcement profile configured in the service
When no rule in an enforcement policy matches, ClearPass falls through to the default enforcement profile defined for that service.
ACMA Authentication Methods 2
Which EAP method uses a client-side certificate for mutual authentication without requiring a server-side password?