ACMA Authentication Methods 5 — Questions and Answers
Question 1: What is the primary security advantage of using certificate-based authentication (EAP-TLS) over credential-based methods (PEAP-MSCHAPv2) in enterprise Wi-Fi?
- Certificates are faster to provision than passwords
- Certificates eliminate the risk of password theft or phishing since no password is transmitted (Correct answer)
- Certificate-based methods work without a RADIUS server
- EAP-TLS requires less bandwidth than PEAP
Correct answer: Certificates eliminate the risk of password theft or phishing since no password is transmitted
EAP-TLS uses X.509 certificates instead of passwords, so there are no credentials to phish or steal — the private key never leaves the client device.
Question 2: In Aruba ClearPass, what is the 'Posture' check used for during authentication?
- Verifying the physical location of the connecting device
- Assessing the security compliance state of the client device (e.g., antivirus, OS patch level) (Correct answer)
- Checking whether the client has a valid RADIUS certificate
- Measuring the signal strength of the wireless client
Correct answer: Assessing the security compliance state of the client device (e.g., antivirus, OS patch level)
Posture assessment in ClearPass evaluates the health of the connecting device (antivirus status, OS updates, firewall state) to enforce compliance-based access policies.
Question 3: Which RADIUS attribute is used to set a session timeout, forcing client re-authentication after a specified number of seconds?
- Idle-Timeout (Attribute 28)
- Session-Timeout (Attribute 27) (Correct answer)
- Acct-Session-Time (Attribute 46)
- Termination-Action (Attribute 29)
Correct answer: Session-Timeout (Attribute 27)
Session-Timeout (RADIUS attribute 27) specifies the maximum number of seconds a client session is allowed before the NAS terminates it or forces re-authentication.
Question 4: What is Opportunistic Wireless Encryption (OWE) and in which scenario is it typically deployed?
- OWE adds password authentication to open SSIDs using SAE
- OWE encrypts traffic on open (unauthenticated) networks without requiring any credentials (Correct answer)
- OWE provides 802.1X authentication for IoT devices
- OWE is Aruba's proprietary encryption for guest networks
Correct answer: OWE encrypts traffic on open (unauthenticated) networks without requiring any credentials
OWE (defined in IEEE 802.11ax and WPA3 Transition mode) provides encryption for open networks using a Diffie-Hellman key exchange, so no password is needed but traffic is still encrypted.
Question 5: When configuring a RADIUS server on an Aruba Mobility Controller, what is the 'NAS IP address' used for?
- The IP address of the RADIUS server to connect to
- The source IP address the controller uses in RADIUS packets sent to the authentication server (Correct answer)
- The IP address assigned to wireless clients after authentication
- The management IP of the ClearPass Policy Manager node
Correct answer: The source IP address the controller uses in RADIUS packets sent to the authentication server
The NAS IP address is the source IP the Aruba controller includes in RADIUS packets and is used by the RADIUS server to identify and authorize the NAS (controller) device.
Question 6: Which authentication method is most appropriate for IoT devices that cannot run an 802.1X supplicant?
- EAP-TLS with device certificates
- MAC Authentication Bypass (MAB) (Correct answer)
- WPA3-Enterprise with SAE
- EAP-PEAP with MSCHAPv2
Correct answer: MAC Authentication Bypass (MAB)
MAC Authentication Bypass (MAB) is used for devices incapable of 802.1X (printers, sensors, cameras) by authenticating them based on their MAC address via RADIUS.
Question 7: In an Aruba deployment using Captive Portal, what is the function of the RADIUS server in a 'web login' profile?
- The RADIUS server is not used in captive portal deployments
- The RADIUS server validates the username and password submitted through the portal page (Correct answer)
- The RADIUS server assigns the SSID profile to the AP
- The RADIUS server handles the TLS certificate for the portal HTTPS page
Correct answer: The RADIUS server validates the username and password submitted through the portal page
In a captive portal web login, the AP or controller forwards the credentials entered on the portal page to the RADIUS server for validation before granting network access.
ACMA Authentication Methods 5
What is the primary security advantage of using certificate-based authentication (EAP-TLS) over credential-based methods (PEAP-MSCHAPv2) in enterprise Wi-Fi?