A county mandates EAP-TLS for staff laptops on the corporate SSID. What strength class does that requirement target?
Select an answer to reveal the explanation.
Short Explanation
Certificates on both sides beat "password inside a PEAP burrito." EAP-TLS is the staff laptop showing a badge and checking the building's badge too. Done right, there is no MSCHAPv2 souvenir for attackers.
Full Explanation
A county mandate for EAP-TLS on staff laptops targets a strength class based on mutual certificate authentication: properly deployed EAP-TLS uses client and server certificates and avoids password-based inner methods that are more susceptible to certain harvesting and spraying patterns. EAP-TLS does not replace RADIUS with a shared PSK written on a whiteboard; AAA remains central. EAP-TLS is not limited to guest open portals and is commonly used to protect staff SSIDs. EAP-TLS does not disable 802.1X or remove the authenticator role from access points or controllers. Exam caveat: certificate lifecycle, private key protection, and server validation still matter—EAP-TLS is strong when operated well, not magical by acronym alone. Operational check: confirm municipal endpoints enroll machine or user certificates, validate that profiles require the expected server trust anchors, and test authorized join with a known-good cert while rejecting unknown presenters. For municipal and campus engagements, keep the finding language tied to authorized scope, name the building or SSID class affected, and state the residual risk to residents or staff if the rejected option had been chosen. Re-validate after the next change window that the selected control still matches inventory, monitoring, and RoE abort criteria used by the city wireless program.