CCNA Access Control and Password Management Questions

Enforce password history determines how many unique new passwords must be used before an old password can be reused. Setting it to 24 prevents reuse of the last 24 passwords, directly meeting the requirement. This is the correct setting because it specifically tracks and blocks previous password hashes, ensuring users cannot cycle back to recent passwords.

This definition aligns perfectly with the Principle of Least Privilege. By restricting access to only what is strictly necessary, an organization significantly reduces the impact of accidental mistakes, insider threats, and external attacks, as an attacker will find themselves limited by the restricted permissions of the compromised account.

Rainbow tables are pre-computed tables of hashes used to crack passwords quickly. By using a unique salt for every user, the set of possible hashes becomes effectively infinite for any given password, rendering rainbow tables useless because they cannot account for the random salt value injected into the hash function.

RADIUS centralizes the decision of which authentication method each account must satisfy. Contractors are mapped to token-based policies while administrators retain password authentication, and because sshd still calls PAM, the existing SSH clients need no changes. This satisfies every constraint in the scenario without duplicating credentials locally.

The principle of least privilege states that users should be granted only the minimum access rights required to perform their job functions. This directly matches the requirement to grant minimum permissions necessary. Applying this principle reduces the attack surface and limits potential damage from compromised accounts, making it a core component of the desired access control system.

Credential stuffing uses lists of username and password pairs obtained from data breaches on other sites. Attackers assume users reuse credentials across services. The scenario explicitly mentions a list of previously breached combinations, which is the hallmark of credential stuffing. Requiring a second factor (like a one-time code) prevents unauthorized access even if the password is correct, effectively mitigating this attack.

A man-in-the-middle attack can intercept the authentication session and relay the one-time code in real time. If the attacker positions themselves between the user and the VPN, they can capture the password and the token code as the user submits them, then use them to authenticate before the code expires. This allows bypassing the hardware token requirement without possessing the physical token.

EAP-TTLS (Extensible Authentication Protocol - Tunneled Transport Layer Security) establishes a TLS tunnel and then authenticates the client using various methods inside that tunnel. This ensures credentials are never sent in cleartext. It is commonly used in VPN and Wi-Fi authentication. The scenario requires encapsulating authentication within a TLS tunnel, which EAP-TTLS does by design, making it the correct choice.

Unique passwords ensure that even if one account's credentials are breached in a data leak, the attacker cannot use those same credentials to access other platforms. This containment strategy isolates the impact of a breach and prevents the automated success typically associated with large-scale credential stuffing campaigns against modern web services.

/etc/login.defs contains configuration settings for the shadow password suite, including the ENCRYPT_METHOD variable, which defines the default password hashing algorithm (e.g., SHA512). Editing this file allows the administrator to enforce a strong, salted algorithm for new passwords. This is the correct file because it controls system-wide password policy defaults.

Time-based one-time password (TOTP) algorithms rely on synchronized clocks. If the token's clock drifts, the generated OTP will not match the server's expected value. Configuring a time drift window allows the server to accept OTPs from a few time steps before or after the current time, compensating for minor clock differences. This directly resolves the synchronization failures.

PBAC uses policies that can incorporate a wide range of attributes and conditions, including environmental factors. It centralizes policy management and enables dynamic, fine-grained access decisions. Often considered an evolution of ABAC, PBAC explicitly emphasizes policy-driven evaluation. It fits the requirement for centralized policy management and auditing, and supports context-aware decisions such as time-of-day restrictions.

Argon2 is the winner of the Password Hashing Competition and is designed to resist GPU cracking. It allows tuning of time cost (CPU), memory cost, and parallelism. This makes it highly adaptable to different hardware and security requirements. The scenario explicitly requires tuning of CPU and memory costs and resistance to GPU attacks, which Argon2 delivers. It is the recommended choice for new applications.