300-425 Question 187
Select 3An organization has deployed a Cisco wireless network using WPA3-Enterprise to secure client connectivity. During a security audit, it is observed that unauthorized devices are attempting to connect to the network using credential-based attacks. The organization wants to enhance its security posture by ensuring only authorized devices can connect, even if valid credentials are used. Which of the following features should the organization implement to achieve this goal?
- A
Enable 802.1X authentication with EAP-TLS
- B
Configure PSK with WPA3-Personal
- C
Implement MAC Filtering on the WLAN
- D
Utilize a RADIUS server with device certificates
- E
Enable Cisco Identity PSK (iPSK) feature
Show answer and explanation
Correct answers: A, D, E
Explanation
The organization can enhance its security posture by implementing features that ensure device-level authentication in addition to user credentials. 802.1X authentication with EAP-TLS and a RADIUS server with device certificates ensure only authorized devices with valid certificates can connect. Cisco Identity PSK (iPSK) adds further granularity and control over which devices can connect by assigning unique keys to specific devices or groups. These measures collectively address the issue of unauthorized devices attempting to connect with valid credentials.
- A. Correct.
802.1X authentication with EAP-TLS uses client certificates for authentication, ensuring that only devices with valid certificates can connect, even if credentials are compromised. This enhances security.
- B. Incorrect.
PSK with WPA3-Personal is not suitable for enterprise environments requiring individual device authentication. It uses a pre-shared key, which does not address the issue of unauthorized devices using valid credentials.
- C. Incorrect.
MAC Filtering provides a basic level of security but can be easily bypassed by attackers spoofing MAC addresses, making it an insufficient solution for this scenario.
- D. Correct.
A RADIUS server with device certificates ensures that only devices with valid certificates can connect, adding an additional layer of security beyond credential-based authentication.
- E. Correct.
The Cisco Identity PSK (iPSK) feature allows different PSKs to be assigned to different devices or user groups, offering enhanced control and security over device connectivity in a WPA3-Enterprise environment.