Which EAP method requires a digital certificate on the server and a password on the client as part of its authentication?

• A. EAP-TLS
• B. EAP-MD5
• C. EAP-TTLS
• D. EAP-FAST

Answer: (C)

The method being tested is about protecting the user’s credentials by first establishing a trusted TLS tunnel with a server certificate, then sending credentials inside that tunnel. EAP-TTLS does exactly that: the server presents a digital certificate to prove its identity and create a secure TLS tunnel, and within that protected channel the client can authenticate using a password (or other non-certificate credentials). This combination—server-side certificate plus password-based client authentication inside a TLS tunnel—matches the description.

Other methods don’t fit as neatly: EAP-TLS requires client certificates as well as a server certificate; EAP-MD5 relies on a simple password exchange without a TLS-protected tunnel; EAP-FAST uses a different provisioning mechanism (PAC) and various inner methods.