hardMultiple ChoiceObjective-mapped
220-1202 Practice Question: A security audit reveals that a company's remote…
A security audit reveals that a company's remote access solution uses a VPN with pre-shared keys (PSK) for authentication. The auditor recommends upgrading to certificate-based authentication. Which of the following is the primary security advantage of certificate-based authentication over PSK?
⚠ Common exam trap
CompTIA often tests the misconception that certificates are 'easier' or 'faster' than PSK, when in reality the primary security advantage is mutual authentication and per-device uniqueness, not operational simplicity or performance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Certificates provide mutual authentication and are unique per device, reducing the risk of a single compromised key affecting all users.
Certificate-based authentication provides mutual authentication, meaning both the VPN client and server verify each other's identity using digital certificates issued by a trusted Certificate Authority (CA). Unlike PSK, which is a shared secret that can be leaked and reused across all devices, each certificate is unique per device, so compromise of one certificate does not expose the entire VPN infrastructure. This significantly reduces the blast radius of a security breach and aligns with the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Certificates are easier to configure and manage than PSK.
Why it's wrong here
While pre-shared keys (PSK) rely on a static shared secret that must be distributed and stored on each endpoint, certificate-based authentication uses a public-key infrastructure (PKI) to bind a device’s identity to a private key, eliminating the shared-secret vulnerability. This option is tempting because centralised certificate management can reduce manual key rotation overhead in large deployments, but the auditor’s concern is specifically the cryptographic weakness of PSK—not administrative convenience—so ease of configuration does not address the security gap.
- ✓
Certificates provide mutual authentication and are unique per device, reducing the risk of a single compromised key affecting all users.
Why this is correct
Certificate-based authentication provides robust mutual authentication, where both the client and the VPN server verify each other's identities using digital certificates issued by a trusted Certificate Authority. Each certificate is unique to a specific device or user, meaning that if one device's certificate is compromised, only that single certificate needs to be revoked. This prevents a widespread security breach that would occur if a shared pre-shared key (PSK) were compromised, which would affect all users.
- ✗
Certificates eliminate the need for a VPN server.
Why it's wrong here
Certificates serve as an authentication mechanism within a Virtual Private Network (VPN) solution, verifying the identity of clients or servers to ensure only authorized entities connect. However, they do not replace the fundamental role of a VPN server, which is responsible for establishing, managing, and terminating the encrypted tunnel, as well as routing traffic securely between the remote client and the internal network. The VPN server is a core component that certificates enhance, not eliminate.
- ✗
Certificates are faster than PSK for establishing VPN connections.
Why it's wrong here
Establishing VPN connections using certificates is generally slower than using pre-shared keys (PSK) due to the inherent computational overhead of asymmetric cryptography. Certificate-based authentication requires complex cryptographic operations, including public key decryption, signature verification, and often a certificate chain validation against a Certificate Authority. This process is significantly more resource-intensive and time-consuming than the simpler symmetric key comparison involved with a PSK.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.