A hospital is enabling 802.1X on its corporate WLAN. Every laptop already carries a machine certificate from the internal PKI, the team wants no password prompt at sign-in, and the device must also confirm it is talking to the real RADIUS server. Which EAP method belongs in the wireless profile?
Select an answer to reveal the explanation.
Short Explanation
Your laptops already carry machine certificates, so EAP-TLS lets the device prove itself with a client certificate instead of a secret. Both sides then show credentials, which covers the mutual-authentication requirement too. It's like a two-way badge check where each person shows ID before the door opens.
Full Explanation
EAP-TLS fits because your endpoints already hold a machine certificate, so the client proves its identity by presenting that certificate instead of typing a secret, which satisfies the no-password requirement while the device also validates the server certificate in the same exchange. That single exchange is what gives you mutual authentication, because each side proves possession of its own key material before any user data flows. PEAP with MSCHAPv2 fails the certificate-identity requirement because the inner method tunnels a username and password, so the endpoint still depends on a human secret and never presents a credential of its own. EAP-FAST similarly wraps an inner method inside a TLS tunnel protected by a protected access credential, but that PAC still leads to a password-based inner exchange rather than certificate proof from the device. EAP-TTLS also relies on a tunneled password exchange, so it verifies the server yet leaves the client side resting on a shared secret. Exam caveat: real WLANs often run mixed modes with legacy clients falling back to PEAP, so read which single method the stated constraints allow. Practical check: watch the client associate and confirm the handshake completes with no credential prompt.