GSEC Access Control and Password Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  EAP-TTLS

  Why this is correct

  EAP-TTLS (Extensible Authentication Protocol - Tunneled Transport Layer Security) establishes a TLS tunnel and then authenticates the client using various methods inside that tunnel. This ensures credentials are never sent in cleartext. It is commonly used in VPN and Wi-Fi authentication. The scenario requires encapsulating authentication within a TLS tunnel, which EAP-TTLS does by design, making it the correct choice.

• ✗

  CHAP

  Why it's wrong here

  CHAP (Challenge Handshake Authentication Protocol) uses a three-way handshake and MD5 hashing to avoid sending the password in cleartext. However, it does not encapsulate authentication within a TLS tunnel. CHAP is vulnerable to offline dictionary attacks if the challenge and response are captured. It does not meet the requirement of using TLS for encapsulation, which provides stronger encryption and integrity.

• ✗

  PAP

  Why it's wrong here

  PAP (Password Authentication Protocol) sends credentials in cleartext. It does not provide encryption or tunneling. Using PAP over the internet would expose passwords to eavesdroppers. While it can be encapsulated within a TLS tunnel (e.g., in a VPN), PAP itself does not provide the necessary security. The requirement is for a protocol that inherently encapsulates authentication within TLS, not one that relies on an external tunnel.

• ✗

  MS-CHAPv2

  Why it's wrong here

  MS-CHAPv2 is a Microsoft challenge-handshake protocol that uses DES encryption and has known vulnerabilities. It does not encapsulate authentication within a TLS tunnel. While it avoids cleartext passwords, it is susceptible to offline cracking. The requirement specifically calls for TLS encapsulation, which MS-CHAPv2 does not provide. Therefore, it is not suitable for this scenario.