A bank will not allow user passwords on the office WLAN and requires each laptop and the authentication server to prove identity with a certificate. Which method fits?
Select an answer to reveal the explanation.
Short Explanation
If nobody is allowed to type a password, do not pick a method whose whole point is to carry one. EAP-TLS makes both your laptop and the server show a certificate. A shared passphrase is a password with extra steps.
Full Explanation
EAP-TLS authenticates both the client and the server with certificates. There is no user password in the exchange. That matches a bank rule that forbids passwords and requires each laptop and the server to prove identity. PEAP protects a user password inside a TLS tunnel. The server has a certificate, and the client typically does not, so it fails both the no-password rule and the client-certificate rule. WPA3-Personal uses SAE and a shared passphrase. A passphrase is a shared secret people know, which is the kind of credential the bank rejected, and there is no per-laptop certificate. MAC authentication compares a hardware address with a list. A serial number or a MAC address is not a certificate, and MAC filtering is easy to spoof, so it does not prove identity the way EAP-TLS does. Exam caveat: EAP-TLS only works after the laptops actually have certificates and trust the server. Choosing the method on the WLAN does not enroll the certificates. Operational check: on a test laptop, confirm a client certificate is present and that the authentication log shows EAP-TLS rather than PEAP or a passphrase success.