CAS-004 Security Engineering Practice Question
A security administrator is configuring a RADIUS server for a wireless network. The administrator wants to ensure that the shared secret between the access point and the RADIUS server is protected against eavesdropping. Which protocol should be used to encapsulate RADIUS traffic?
⚠ Common exam trap
Candidates often confuse authentication protocols like EAP-TTLS with transport protection mechanisms for RADIUS itself, or assuming that IPsec is the only way to secure RADIUS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RADIUS over TLS (RadSec)
RadSec (RADIUS over TLS) is the standard protocol for securely encapsulating RADIUS traffic. It uses TLS to encrypt the entire RADIUS conversation, including the shared secret, protecting against eavesdropping. Other options either do not encrypt the RADIUS packet fully or are authentication methods that do not address the shared secret protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RADIUS with MS-CHAPv2
Why it's wrong here
MS-CHAPv2 is an authentication protocol that can be used with RADIUS, but it does not protect the RADIUS shared secret. It is also considered weak due to vulnerabilities. The shared secret is still used to encrypt the MS-CHAPv2 response, but the RADIUS packet itself is not encrypted. This does not meet the requirement.
- ✓
RADIUS over TLS (RadSec)
Why this is correct
RadSec encapsulates RADIUS in TLS, providing encryption and integrity for the shared secret and all authentication traffic. Standard RADIUS uses a shared secret to obfuscate passwords but does not encrypt the entire packet, leaving it vulnerable to eavesdropping. RadSec protects against this by securing the entire communication channel.
- ✗
RADIUS over UDP with IPsec transport mode
Why it's wrong here
IPsec transport mode can encrypt RADIUS traffic, but it is not specifically designed for RADIUS and requires additional configuration. While it can protect the shared secret, it is more complex to manage and not as streamlined as RadSec. The question asks for the protocol to encapsulate RADIUS; RadSec is the dedicated solution.
- ✗
RADIUS with EAP-TTLS
Why it's wrong here
EAP-TTLS is an authentication method used within RADIUS to tunnel other authentication protocols, but it does not protect the RADIUS shared secret itself. The shared secret is still used to encrypt certain attributes, but the RADIUS packet is not fully encrypted. EAP-TTLS operates at a higher layer and does not encapsulate RADIUS.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.