An EAP response message may contain ________.

• A. a request for a different authentication mechanism
• B. a negative acknowledgement
• C. Both a request for a different authentication mechanism and a negative acknowledgement
• D. Neither a request for a different authentication mechanism nor a negative acknowledgement

Answer: (B)

In EAP exchanges, the peer responds to the authenticator’s challenge with an EAP-Response. If the authenticator asks for a specific authentication method that the peer cannot perform, the peer uses a negative acknowledgement (NAK) in the EAP-Response. This signals, “I can’t use that method; offer another one.” The authenticator then proposes a different method in a subsequent EAP-Request that the peer may support.

A request for a different authentication mechanism is typically sent by the authenticator as a new Request, not contained in the Response. So the response itself is the place where a negative acknowledgement may appear, making it the best answer.