A city asks whether a strong Active Directory password alone makes PEAP safe against evil twins if users skip server certificate checks. What is the right risk answer?
Select an answer to reveal the explanation.
Short Explanation
A fortress password still fails if staff walk into a fake PEAP desk and never check the server cert. Strength does not stop evil-twin credential handoff when validation is skipped.
Full Explanation
PEAP tunnels an inner authentication method, commonly MSCHAPv2, inside TLS. If clients do not validate the RADIUS server certificate, they can complete that tunnel to a rogue Enterprise twin. Password complexity does not create a cryptographic bind to the legitimate AP or replace certificate checks, nor does it make PMF alone defeat rogue SSIDs. Municipal hardening must enforce server-certificate validation on endpoints.