Free Cisco 300-730 SVPN Actual Exam Questions - Question 1 Discussion
upcoming Cisco AnyConnect deployment. A list of the security requirements from upper
management are: the ability to force AnyConnect users to use complex passwords such as
C1$c0451035084!, warn users a few days before their password expires, and allow users to change
their password during a remote access session. Which authentication protocol must be used to meet
these requirements?
That’s a good point about RADIUS mostly just forwarding requests without enforcing password rules. I’d back A (LDAPS) because it connects straight to Active Directory, so it can handle complex password policies, expiration warnings, and let users change passwords remotely. Those features depend on the directory’s policies, which LDAPS accesses directly.
A. I agree with the call on LDAPS here because it’s basically LDAP over SSL, so it can communicate directly with Active Directory to enforce those password policies, including complexity and expiration warnings. RADIUS and TACACS+ mainly handle authentication but don’t manage password complexity or expiration on their own. Kerberos is more for single sign-on and ticketing, not password management. So if password control features are a must, LDAPS is the only one that really fits the bill for these requirements.
Not B, because RADIUS mainly handles authentication requests but doesn’t directly enforce password complexity or expiration policies—that’s usually the directory service’s job, which fits better with A (LDAPS).
I’m thinking it’s A. LDAPS because it directly communicates with Active Directory, which actually enforces password complexity, expiration warnings, and allows password changes during sessions.
B. RADIUS supports enforcing password policies through integration with AD, plus it can notify users about expiration and handle password changes during sessions, making it a solid choice for remote access environments.
A. LDAPS is the only one here that directly hooks into Active Directory to enforce password complexity and expiration policies while letting users change passwords remotely, unlike RADIUS or TACACS+.
A. LDAPS fits because it integrates directly with Active Directory, which manages password policies, expiration warnings, and allows changes remotely—stuff RADIUS or TACACS+ alone don't handle natively.
Option B sounds right since RADIUS usually supports password complexity and notifications.