CISSP Practice Question: Is configuring 802.1X authentication for wired…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Client certificate

  Why this is correct

  EAP-TLS (Extensible Authentication Protocol - Transport Layer Security) is a robust, certificate-based EAP method designed for strong mutual authentication. For a client to successfully authenticate using EAP-TLS, it must possess and present its own digital certificate to the authentication server (e.g., RADIUS server). This client certificate serves as proof of identity, allowing the server to verify the client's legitimacy and establish a secure, trusted communication channel before granting network access. Without a valid client certificate, EAP-TLS authentication cannot proceed.

• ✗

  Server certificate

  Why it's wrong here

  While a server certificate is absolutely essential for the authentication server (such as a RADIUS server) to establish its identity to the client during an EAP-TLS handshake, it is not a component that the client itself needs to possess or present. The client's role regarding the server certificate is to validate its authenticity and trust chain, ensuring it is communicating with a legitimate authentication server. The server certificate is issued to and resides on the authentication server, not the client device, making it distinct from a client-side requirement.

• ✗

  RADIUS server

  Why it's wrong here

  A RADIUS (Remote Authentication Dial-In User Service) server functions as the central authentication, authorization, and accounting (AAA) server within an 802.1X infrastructure. Its role is to receive authentication requests from the authenticator (e.g., network switch or access point), validate client credentials, and then authorize or deny network access. Therefore, a RADIUS server is a critical backend component of the authentication system, not a credential or resource that the client itself requires to initiate or complete its authentication process.

• ✗

  Shared secret

  Why it's wrong here

  A shared secret, also known as a pre-shared key, is a symmetric key used for authentication or encryption that is known only to the communicating parties. While shared secrets are fundamental to certain EAP methods like EAP-MD5 or for securing communication between the authenticator and the RADIUS server, they are entirely irrelevant for client authentication within EAP-TLS. EAP-TLS relies exclusively on asymmetric cryptography and digital certificates for robust mutual authentication, rendering shared secrets unnecessary for the client's identity verification process.

Go deeper

Related to this question