hardMultiple ChoiceObjective-mapped
CISA An IS auditor reviews the log entry above Practice Question
Exhibit
Refer to the exhibit. ``` [Error] Authentication failed for user 'john.doe' from IP 10.0.0.5. Timestamp: 2024-03-21 14:32:15 UTC Log Source: RADIUS Server Additional Info: Invalid certificate CN in client certificate. ```
An IS auditor reviews the log entry above. Which of the following is the MOST likely cause of the authentication failure?
⚠ Common exam trap
ISACA often tests the distinction between certificate validation errors (like CN mismatch) and other authentication failures (like wrong password or account lockout), expecting candidates to recognize that certificate-based authentication failures are tied to the certificate's attributes, not user credentials or server availability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The client certificate presented has a common name that does not match the configured expected name.
The log entry indicates an authentication failure with a client certificate. The error 'CN mismatch' or similar certificate validation failure occurs when the Common Name (CN) in the client certificate does not match the expected name configured on the server (e.g., in a RADIUS or TLS mutual authentication context). This is a specific certificate-level issue, not a password or account lockout problem.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user's account is locked.
Why it's wrong here
Account lockout would not produce a certificate CN error.
- ✗
The user's password is incorrect.
Why it's wrong here
The error is about certificate CN, not password.
- ✓
The client certificate presented has a common name that does not match the configured expected name.
Why this is correct
Error message states 'Invalid certificate CN'.
- ✗
The RADIUS server is unavailable.
Why it's wrong here
The log is from the RADIUS server, so it is available.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.