CISA Protection of Information Assets Practice Question
An IS auditor is evaluating the security of an organization's wireless network. The organization uses WPA3-Enterprise with 802.1X authentication against a RADIUS server. The auditor discovers that the RADIUS server is configured to accept EAP-MD5 as an authentication method for legacy devices. Which of the following is the MOST significant security concern with this configuration?
⚠ Common exam trap
The trap here is focusing on the cryptographic weakness of MD5 hashing while overlooking that the absence of mutual authentication is what enables the rogue access point attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EAP-MD5 does not support mutual authentication, allowing a rogue access point to capture user credentials.
EAP-MD5 is a legacy EAP method that authenticates only the client to the server, not the server to the client. Without mutual authentication, an attacker can deploy a rogue access point to impersonate the legitimate network, capture the client's MD5-hashed credentials, and crack them offline. Enabling EAP-MD5 on a RADIUS server for WPA3-Enterprise therefore introduces a serious credential theft vector.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
EAP-MD5 requires the use of a public key infrastructure (PKI) that the organization may not have deployed.
Why it's wrong here
EAP-MD5 is based on a username and password hashed with MD5; it does not require a PKI. Methods such as EAP-TLS require client certificates and a PKI. The concern with EAP-MD5 is its weak, non-mutual authentication, not a PKI dependency. Stating a PKI requirement misrepresents how EAP-MD5 operates and distracts from the actual vulnerability.
- ✓
EAP-MD5 does not support mutual authentication, allowing a rogue access point to capture user credentials.
Why this is correct
EAP-MD5 provides only one-way authentication of the client to the server and does not support mutual authentication. An attacker can set up a rogue access point that impersonates the legitimate network, prompting the client to send its MD5-hashed credentials, which can then be captured and cracked offline. This makes it the most significant concern because it directly enables credential theft and network compromise.
- ✗
EAP-MD5 is incompatible with WPA3-Enterprise and will cause the wireless network to fall back to WPA2.
Why it's wrong here
WPA3-Enterprise can operate with various EAP methods, including EAP-MD5, although using weak methods undermines WPA3's security benefits. The protocol does not automatically downgrade to WPA2 because of the EAP method. The real risk is that EAP-MD5 lacks mutual authentication, not a forced protocol downgrade, so this option misidentifies the technical behavior.
- ✗
EAP-MD5 transmits credentials in cleartext, exposing them to eavesdropping on the wireless medium.
Why it's wrong here
EAP-MD5 does not transmit the password in cleartext; it sends an MD5 hash of the password and a challenge. However, this hash is vulnerable to offline dictionary attacks. The statement that credentials are sent in cleartext is factually incorrect. The more accurate and significant concern is the lack of mutual authentication, which enables rogue access point attacks.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.