mediumMultiple ChoiceObjective-mapped
220-1202 Practice Question: A company's IT policy requires that all wireless…
A company's IT policy requires that all wireless connections use certificate-based authentication to prevent unauthorized access. The network is currently using WPA2-PSK. Which configuration change is necessary to meet this policy?
⚠ Common exam trap
The 220-1202 exam often tests the distinction between Personal and Enterprise modes, where candidates mistakenly think upgrading to WPA3-Personal (Option B) adds certificate support, but only the Enterprise mode with a RADIUS server enables certificate-based authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Switch to WPA2-Enterprise and configure a RADIUS server.
The policy requires certificate-based authentication, which is a feature of WPA2-Enterprise (802.1X). WPA2-Enterprise uses a RADIUS server to validate certificates and authenticate users individually, replacing the pre-shared key (PSK) model. This meets the requirement for certificate-based authentication to prevent unauthorized access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable MAC address filtering on the access point.
Why it's wrong here
MAC address filtering restricts network access to devices based on their unique hardware addresses. While it adds a minor, additional layer of security by requiring an administrator to pre-approve devices, it does not provide certificate-based authentication as required by the policy. Furthermore, MAC addresses can be easily spoofed, making this a weak and unreliable security measure that is not suitable for robust authentication requirements.
- ✗
Upgrade to WPA3-Personal.
Why it's wrong here
WPA3-Personal, while offering enhanced security features like Simultaneous Authentication of Equals (SAE) to mitigate dictionary attacks, still operates on a pre-shared key (PSK) model. This means authentication relies on a common passphrase known to all authorized users, not individual digital certificates. Therefore, it fails to meet the company's policy requirement for certificate-based authentication for wireless connections.
- ✓
Switch to WPA2-Enterprise and configure a RADIUS server.
Why this is correct
WPA2-Enterprise is the appropriate solution because it leverages the 802.1X authentication framework, which is designed for robust, centralized user and device authentication. This framework integrates with a RADIUS (Remote Authentication Dial-In User Service) server, allowing for authentication against various credentials, including digital certificates. By configuring a RADIUS server to issue and validate certificates, the company can effectively enforce its policy for certificate-based authentication on wireless connections.
- ✗
Change the encryption from AES to TKIP.
Why it's wrong here
Changing encryption from AES (Advanced Encryption Standard) to TKIP (Temporal Key Integrity Protocol) would significantly degrade network security rather than enhance it. TKIP is an older, weaker encryption protocol designed as a stopgap for WPA and is known to have vulnerabilities, making it deprecated for modern use. Crucially, TKIP only provides data encryption and integrity; it does not offer or facilitate certificate-based authentication for users or devices, which is the core requirement of the IT policy.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.