Which of the following authentication protocols is least likely to be used to establish a point-to-point connection?
A. EAP-MD5
B. Password Authentication Protocol (PAP)
C. Extensible Authentication Protocol (EAP)
D. Challenge-Handshake Authentication Protocol (CHAP)

Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.

My suggested answer is C. Extensible Authentication Protocol (EAP).

Password Authentication Protocol (PAP) sends unencrypted passwords. It’s weaker than EAP-MD5 and CHAP (both use MD5). So, PAP is least likely to be used among the three authentication protocols.

Extensible Authentication Protocol (EAP) is not used directly in the authentication process. Instead, it is an authentication framework upon which an EAP-based authentication protocol is developed. Authentication protocols developed based on the EAP framework, e.g., EAP-TLS, EAP-TTLS, PEAP, etc., are used for authentication.

Extensible Authentication Protocol (EAP) is an authentication framework frequently used in network and internet connections. It is defined in RFC 3748, which made RFC 2284 obsolete, and is updated by RFC 5247. EAP is an authentication framework for providing the transport and usage of material and parameters generated by EAP methods. There are many methods defined by RFCs and a number of vendor specific methods and new proposals exist. EAP is not a wire protocol; instead it only defines the information from the interface and the formats. Each protocol that uses EAP defines a way to encapsulate by the user EAP messages within that protocol’s messages.

EAP is in wide use. For example, in IEEE 802.11 (WiFi) the WPA and WPA2 standards have adopted IEEE 802.1X (with various EAP types) as the canonical authentication mechanism.

Source: Wikipedia

Reference

• Extensible Authentication Protocol

A BLUEPRINT FOR YOUR SUCCESS IN CISSP

My new book, The Effective CISSP: Security and Risk Management, helps CISSP aspirants build a solid conceptual security model. It is not only a tutorial for information security but also a study guide for the CISSP exam and an informative reference for security professionals.

• It is available on Amazon.
• Readers from countries or regions not supported by Amazon can get your copy from the author’s web site.

以下哪種身份驗證協議(authentication protocol)最不可能用於建立點對點(point-to-point)連接？
A. EAP-MD5
B. Password Authentication Protocol (PAP)
C. Extensible Authentication Protocol (EAP)
D. Challenge-Handshake Authentication Protocol (CHAP)