A firm is turning on 802.1X on its WLAN. Staff laptops already carry machine certificates from the internal CA and must use certificate-based mutual authentication, while contractor phones are unmanaged, hold only usernames and passwords, and IT forbids any profile installation on them. Which EAP method assignment fits both groups?
Select an answer to reveal the explanation.
Short Explanation
Your two groups arrive with different credentials, so you're matching a different handshake to each. EAP-TLS goes to the laptops that already trust the internal CA and PEAP-MSCHAPv2 to phones that only know a password, like checking a badge at one gate and a day pass at another.
Full Explanation
The correct assignment uses EAP-TLS with the laptops’ machine certificates, providing certificate-based client authentication and allowing the RADIUS server to authenticate with its certificate. PEAP-MSCHAPv2 gives the contractor phones a password-based method compatible with the credentials they have, without requiring certificate enrollment. Separate allowed methods let each group use a suitable authentication method. Using PEAP-MSCHAPv2 for both groups is a common way to simplify WLAN policy, but it fails the explicit laptop requirement: passwords do not use the laptops’ machine certificates for mutual authentication. Requiring a PEAP server-trust profile on contractor phones can improve server validation, but it violates the prohibition on installing any profile, even though the phones’ passwords would otherwise work. Issuing client certificates to contractor phones is a conventional BYOD design, but it changes the stated credential situation: these phones have only usernames and passwords, and the scenario provides no certificate enrollment. Exam caveat: PEAP is an outer EAP method; its inner method and server-certificate validation settings matter, and support varies by client platform. Practical check: verify the actual supplicant settings and RADIUS policy for each device group, including laptop machine-certificate selection, trusted server identity, and the phone’s ability to connect without an installed profile.