SY0-701 Question 207
Single answerPort security: 802.1X , Extensible Authentication Protocol (EAP)A company is deploying 802.1X on access switch ports to prevent unauthorized devices from connecting to the corporate network. Employees use domain-joined laptops with certificates issued by the internal PKI. During testing, security administrators want a solution that provides mutual authentication between the client and the authentication server and does not rely on users typing passwords at logon. Which EAP method should the administrator choose for this deployment?
- A
EAP-TLS
- B
PEAP-MSCHAPv2
- C
EAP-MD5
- D
PAP
Show answer and explanation
Correct answer: A
Explanation
The best choice is EAP-TLS because the scenario explicitly calls for mutual authentication and avoidance of password-based user logons. In 802.1X deployments, EAP-TLS is widely recommended when an organization has an internal PKI and can issue client certificates to managed devices. It authenticates both the supplicant and the authentication server, which helps prevent rogue authentication infrastructure and strengthens port-based access control. PEAP-MSCHAPv2 is still common in some environments, but it generally uses passwords and therefore does not fully satisfy the requirement. EAP-MD5 and PAP are not considered appropriate for secure enterprise network access control. This aligns with enterprise best practices for 802.1X and EAP deployments described in vendor documentation from major network and identity providers, as well as guidance from standards-based 802.1X implementations.
- A. Correct.
Correct. EAP-TLS is a strong 802.1X authentication method that uses client and server certificates to provide mutual authentication. It is commonly deployed in enterprise wired and wireless 802.1X environments when an organization has a PKI. Because authentication is certificate-based, it does not depend on the user manually entering a password during logon. This aligns well with domain-managed corporate laptops that already have machine certificates.
- B. Incorrect.
Incorrect. PEAP-MSCHAPv2 protects the authentication exchange inside a TLS tunnel and is widely used, but it typically relies on username/password credentials rather than client certificates for endpoint authentication. It can provide server-side certificate validation and secure the password exchange, but it does not meet the requirement to avoid password-based logon authentication in the same way EAP-TLS does.
- C. Incorrect.
Incorrect. EAP-MD5 is not appropriate for secure enterprise 802.1X access control. It does not provide mutual authentication and is considered weak because it does not support certificate-based server authentication or robust protection against credential attacks. Someone might choose this option because it is an EAP type, but it is not a best-practice choice for modern secure deployments.
- D. Incorrect.
Incorrect. PAP is a simple password authentication protocol, not an EAP method designed for secure 802.1X enterprise access control. It transmits credentials in a weak form and does not provide mutual authentication. This option is a plausible distractor because it is related to authentication, but it is not suitable for this scenario.