Using Digital Certificates for Enterprise Device Authentication

200-301 By islever Editorial Last updated

Describe security password policies elements, such as management, complexity, and password alternatives (multifactor authentication, certificates, and biometrics)

Short answer

D Digital certificates let enterprise devices authenticate to the network (e.g., 802.1X/EAP-TLS) without passwords.

Question

Which alternative to password authentication is implemented to allow enterprise devices to log in to the corporate network?
  1. 90-day renewal policies
  2. magic links
  3. one-time passwords
  4. digital certificates Correct Answer

Key Takeaways

A certificate is a device/identity credential that replaces the password in enterprise auth (EAP-TLS); the other options are either password practices or temporary codes.

Certificates are a credential type used as a password alternative: a device presents a machine certificate to prove identity, commonly via 802.1X EAP-TLS. One-time passwords and magic links are still knowledge/possession factors, and renewal policies are just password hygiene.

Common mistake: Picking one-time passwords (C) or magic links (B): those are still shared-secret/knowledge mechanisms, not a true password alternative like a certificate. Renewal policies (A) govern passwords, not replace them.

Expert Analysis

Why the Answer Is Correct

D is correct. Digital certificates are a credential type used as a password alternative: a device presents a machine certificate to prove identity, typically via 802.1X EAP-TLS, so no password is needed.

Why the Other Options Are Wrong

A (90-day renewal) is a password policy, not an alternative. B (magic links) and C (one-time passwords) are still shared-secret/knowledge mechanisms. Only a certificate replaces the password for device auth.

Community Comment Notes

The vote is D (100). One commenter notes 'magic links' is a real (if weak) concept but not the enterprise device-auth alternative the question asks for.

Official Reference

https://learningnetwork.cisco.com/s/ccna-exam-topics

This link opens the official vendor documentation in a new tab.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. 379c9f6 👍 5
    Congratulation for reaching 1384.
  2. bezkin 👍 1 Answered D
    D is correct, but i thought "magic links" was a made up thing. apparently it refers to the ultra long, timed links you sometimes get to reset your password / verify your email for some websites.
  3. siri_8932 👍 4
    OMG!!!Finally
  4. MinSun600 👍 2
    D is correct answer

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Rapid PVST+ Port State That Neither Receives BPDUs nor Learns MAC

S-grade

Computing the EUI-64 Interface ID for a Given MAC Address

S-grade

Electing the Root Bridge in PVST+ by Priority and MAC

S-grade

How a Switch Handles an ARP Request for an Unknown Destination

S-grade

Practice All 200-301 Questions

Access 220 questions with complete answers and detailed explanations.

View Full 200-301 Practice Test →

← Back to 200-301 Study Guide