mediumMultiple ChoiceObjective-mapped
220-1201 Practice Question: A technician is troubleshooting why a new…
A technician is troubleshooting why a new employee cannot log into the company's VPN. The VPN uses RADIUS for authentication. Other employees can connect successfully. Which is the most likely cause?
⚠ Common exam trap
The key point is that a centralized authentication failure affecting only one user points to a missing or misconfigured user account in the authentication database, not a network or server-wide issue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The new employee's account is not configured in the RADIUS database.
Since other employees can connect successfully, the VPN server, RADIUS server, and network connectivity between them are functional. The issue is isolated to the new employee, making it most likely that their account has not been added to the RADIUS database. RADIUS authenticates users against a local or directory-based user store; if the account is missing, authentication will fail for that user alone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPN server's IP address has changed.
Why it's wrong here
If the VPN server's IP address had changed, all existing employees attempting to connect using the old IP address or a hostname resolving to the old IP would experience connection failures. Since other employees are successfully connecting, this indicates that the VPN server itself is operational and reachable at its expected network address. A change in the server's fundamental network identifier would not selectively prevent only a new employee from connecting while others proceed normally.
- ✗
The RADIUS server is not reachable from the VPN server.
Why it's wrong here
The RADIUS server is responsible for authenticating all users attempting to connect to the VPN. If the RADIUS server were unreachable from the VPN server, the VPN server would be unable to forward any authentication requests, leading to a complete failure for all users, regardless of their account status. The fact that other employees can successfully authenticate and connect to the VPN disproves a general communication issue between the VPN server and the RADIUS server.
- ✓
The new employee's account is not configured in the RADIUS database.
Why this is correct
The RADIUS server acts as a centralized authentication service, verifying user credentials against its internal database or an integrated directory service. If the new employee's account has not been provisioned or correctly configured within the RADIUS database, their authentication attempt will consistently fail, even if the VPN server is reachable and other users' accounts are valid. This scenario precisely explains why only a specific new user cannot connect, while existing users face no issues.
- ✗
The DNS server is not resolving the VPN server's hostname.
Why it's wrong here
DNS resolution is a network-wide service that translates hostnames into IP addresses for all clients. If the DNS server were failing to resolve the VPN server's hostname, all users attempting to connect by that hostname would be unable to locate the VPN server's IP address and thus could not establish a connection. The successful connections by other employees confirm that DNS resolution for the VPN server's hostname is functioning correctly for the network.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1201 question from scratch — 972 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1201 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1201 exam.