100-160 Question 33
Select 2Your organization has implemented a RADIUS server to centralize authentication, authorization, and accounting (AAA) for network devices. However, a recent audit revealed that several users are sharing passwords, posing a security risk. Which two measures should you recommend to enhance the security of user authentication in this setup?
- A
Implement multifactor authentication (MFA) to require an additional layer of verification.
- B
Enforce a password policy that includes complexity requirements and regular expiration.
- C
Allow password sharing among trusted employees to improve operational efficiency.
- D
Disable RADIUS accounting to reduce overhead and simplify the authentication process.
- E
Integrate the RADIUS server with an external identity provider that supports strong authentication mechanisms.
Show answer and explanation
Correct answers: A, B
Explanation
To address the security risk of shared passwords, it is crucial to strengthen the authentication process. Multifactor authentication (MFA) mitigates risks by requiring an additional verification factor, such as a one-time code or biometric authentication. Additionally, enforcing a robust password policy ensures that passwords are strong, unique, and changed regularly, making them less vulnerable to compromise. These measures significantly enhance the security of the RADIUS-based AAA system.
- A. Correct.
Implementing MFA adds an additional layer of security beyond just a password, reducing the risk of compromised credentials.
- B. Correct.
Enforcing a password policy ensures that passwords are strong and updated regularly, making them harder to guess or reuse.
- C. Incorrect.
Allowing password sharing undermines security and increases the likelihood of unauthorized access.
- D. Incorrect.
Disabling RADIUS accounting removes a critical component of tracking and auditing user activities, which is counterproductive to security.
- E. Incorrect.
While integrating with an external identity provider can enhance authentication, it is not directly addressing the issue of password sharing or weak authentication in the current scenario.