CWSP-208 VCE Exam Download

EAP-TLS requires both server and client-side digital certificates, which adds complexity in client certificate management.

EAP-TTLS uses a server certificate to establish a secure TLS tunnel, after which user credentials (e.g., username/password) are sent inside the encrypted tunnel. No client certificate is needed.

Incorrect:

A. EAP-TLS also encrypts credentials using TLS.

B. EAP-TLS supports client certificates (it’s the core requirement).

C. Both EAP methods require an authentication server.

Rogue APs pose a significant risk and should be detected and mitigated automatically.

D. A properly configured Wireless Intrusion Prevention System (WIPS) can detect unauthorized APs and prevent client associations to them in real time.

Incorrect:

A. While WPA2-Enterprise adds client-level protection, it does not detect rogue APs.

B. Hiding SSIDs is ineffective—SSIDs are still discoverable in management frames.

C. Manual scans are labor-intensive and impractical for ongoing monitoring.

E. Port security controls wired threats but cannot detect rogue APs using wireless signals.

EAP-TTLS (Tunneled Transport Layer Security) supports flexible inner authentication methods including:

MS-CHAPv2

EAP-GTC (Generic Token Card)

EAP-TLS (in some configurations)

This versatility allows EAP-TTLS to be used with a wide range of back-end authentication systems, while only requiring a server-side certificate.

Incorrect:

A. H-REAP (now FlexConnect) is a Cisco AP deployment mode, not an EAP type.

B. EAP-GTC is a simple authentication method and not a tunnel or container for others.

D. PEAP typically supports MS-CHAPv2 but not EAP-GTC or EAP-TLS as inner methods.

E. LEAP uses MS-CHAPv1 and is considered deprecated and insecure.

The Pairwise Transient Key (PTK) is derived during the 4-Way Handshake and is used to generate:

The EAPOL-Key Confirmation Key (KCK)

The EAPOL-Key Encryption Key (KEK)

The Temporal Key (TK), which encrypts unicast traffic

Incorrect:

A. The Group Master Key (GMK) is used to derive the GTK, not the PTK.

C. PTK is not XOR’d with the PSK—PTK is derived from PMK + other session parameters.

D. PMK is never encrypted or transmitted; it is pre-shared or derived and remains local.