Which two solutions address the requirements for an IoT wireless authentication solution that requires encrypted traffic, unique per-device passphrases, and fingerprint-based role-based access?

Which two solutions address the requirements for an IoT wireless authentication solution that requires encrypted traffic, unique per-device passphrases, and fingerprint-based role-based access?

• A. MPSK and an internal RADIUS server
• B. MPSK Local with MAC Authentication
• C. ClearPass Policy Manager
• D. MPSK Local with EAP-TLS

Answer: (C)

This question is testing the ability to pick a solution that provides encrypted wireless traffic, unique per-device credentials, and RBAC based on device identity (fingerprinting) for IoT. ClearPass Policy Manager serves as a centralized policy engine that integrates with the wireless network to enforce 802.1X/RADIUS-based authentication and authorization. It can issue and manage per-device credentials, typically through certificate-based methods like EAP-TLS, giving each IoT device its own identity rather than sharing a key. It also supports device fingerprinting to recognize devices by characteristic traits and map them to specific roles, enabling fingerprint-based RBAC. In short, ClearPass directly delivers encrypted traffic at the wireless layer, unique device credentials, and policy-driven access based on device identity. The other options rely on shared keys or MAC-based identity, which have significant limitations. Master PSKs (MPSK) involve keys shared across devices or derived keys, which do not scale well for per-device identity and robust RBAC. Local MPSK with MAC Authentication depends on MAC addresses, which can be spoofed and provide weak control, and adding EAP-TLS in a mixed, local-PSK setup still lacks the centralized, fingerprint-driven policy enforcement that ClearPass offers.

This question is testing the ability to pick a solution that provides encrypted wireless traffic, unique per-device credentials, and RBAC based on device identity (fingerprinting) for IoT.

ClearPass Policy Manager serves as a centralized policy engine that integrates with the wireless network to enforce 802.1X/RADIUS-based authentication and authorization. It can issue and manage per-device credentials, typically through certificate-based methods like EAP-TLS, giving each IoT device its own identity rather than sharing a key. It also supports device fingerprinting to recognize devices by characteristic traits and map them to specific roles, enabling fingerprint-based RBAC. In short, ClearPass directly delivers encrypted traffic at the wireless layer, unique device credentials, and policy-driven access based on device identity.

The other options rely on shared keys or MAC-based identity, which have significant limitations. Master PSKs (MPSK) involve keys shared across devices or derived keys, which do not scale well for per-device identity and robust RBAC. Local MPSK with MAC Authentication depends on MAC addresses, which can be spoofed and provide weak control, and adding EAP-TLS in a mixed, local-PSK setup still lacks the centralized, fingerprint-driven policy enforcement that ClearPass offers.