mediumMultiple ChoiceObjective-mapped
220-1201 Practice Question: A technician is configuring a new wireless…
A technician is configuring a new wireless network for a small business. The owner wants to ensure that only company-issued laptops can connect, and that data is encrypted. The laptops support WPA2-Enterprise. Which authentication method should be used?
⚠ Common exam trap
CompTIA often tests the distinction between personal-mode (PSK/SAE) and enterprise-mode (802.1X/RADIUS), and the trap here is that candidates see 'WPA2-Enterprise' in the question but then incorrectly choose WPA2-PSK or WPA3-SAE because they focus on encryption strength rather than the authentication mechanism required for per-device control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
802.1X with a RADIUS server
WPA2-Enterprise uses 802.1X authentication, which requires a RADIUS server to validate individual user or device credentials. This allows the business to enforce that only company-issued laptops (which have the correct certificates or credentials) can connect, while also providing strong per-session encryption via dynamic WPA2 keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
WPA2-PSK with a strong passphrase
Why it's wrong here
WPA2-PSK (Pre-Shared Key) relies on a single, shared secret passphrase for all devices to authenticate to the wireless network. While a strong passphrase enhances the encryption of data in transit, it fundamentally lacks individual device authentication. This means anyone possessing the passphrase can connect, making it impossible to restrict access exclusively to authorized company laptops or to revoke access for a single compromised device without affecting all other legitimate users.
- ✗
WPA3-SAE (Simultaneous Authentication of Equals)
Why it's wrong here
WPA3-SAE (Simultaneous Authentication of Equals) is an advanced personal mode that significantly improves upon WPA2-PSK by offering enhanced security features like forward secrecy and resistance to offline dictionary attacks. However, it still operates on a shared passphrase model, meaning all connecting devices use the same credential for network access. This design inherently prevents the granular control and per-device authentication necessary to ensure only specific, authorized company laptops can join the network.
- ✓
802.1X with a RADIUS server
Why this is correct
802.1X provides robust, port-based network access control, requiring each connecting device to authenticate individually before gaining network access. It leverages a RADIUS (Remote Authentication Dial-In User Service) server to centralize authentication, authorization, and accounting (AAA) policies. This allows the network to verify the identity of each company laptop using credentials like certificates or usernames/passwords, ensuring only authorized devices can connect and enabling precise control over access.
- ✗
MAC address filtering
Why it's wrong here
MAC address filtering attempts to control network access by creating a whitelist or blacklist of Media Access Control (MAC) addresses. However, this method is fundamentally insecure and easily bypassed because MAC addresses are broadcast in the clear and can be readily discovered and spoofed by malicious actors. Furthermore, MAC filtering provides no encryption for network traffic and does not authenticate the *user* or *device* in a cryptographically secure manner, making it trivial to circumvent for unauthorized access.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1201 question from scratch — 972 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1201 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1201 exam.