easyMultiple ChoiceObjective-mapped
220-1202 Practice Question: A small business wants to ensure that only…
A small business wants to ensure that only authorized employees can access the file server from their laptops. Each laptop has a unique hardware ID. Which logical security method should be implemented to enforce this restriction?
⚠ Common exam trap
Watch out — candidates often confuse user authentication (passwords) with device authentication (MAC filtering), assuming that a strong password alone can restrict access to specific hardware, when in fact passwords only verify the user, not the device.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable MAC address filtering on the network switch or router.
MAC address filtering on the network switch or router allows the administrator to create an access control list (ACL) that permits only specific hardware MAC addresses to connect to the network. Since each laptop has a unique hardware ID (MAC address), this method directly ties network access to the authorized devices, ensuring only those laptops can reach the file server. This is a logical security control implemented at Layer 2 of the OSI model.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require a complex password for the file server share.
Why it's wrong here
Requiring a complex password for the file server share enhances user authentication security by making credentials harder to guess or crack. However, this measure primarily verifies the user's identity rather than the device's authorization. An authorized user with valid credentials could still access the file server from any laptop, including an unauthorized one, as long as they possess the correct password. This does not restrict access to specific, authorized laptops.
- ✓
Enable MAC address filtering on the network switch or router.
Why this is correct
Enabling MAC address filtering on a network switch or router directly addresses the requirement to ensure only authorized laptops can access resources. This method operates at Layer 2 (Data Link Layer) of the OSI model, allowing the network device to inspect the Media Access Control (MAC) address of connecting devices. By creating a whitelist of approved MAC addresses, the switch or router will only permit network connectivity for those specific, authorized laptops, effectively blocking all others.
- ✗
Install a host-based firewall on each laptop.
Why it's wrong here
Installing a host-based firewall on each laptop provides protection for that individual laptop by controlling its inbound and outbound network traffic. While crucial for endpoint security, a host-based firewall does not regulate which other devices are permitted to connect to the network or access shared resources like a file server. It protects the laptop it resides on, but it does not prevent an unauthorized laptop from attempting to connect to the file server itself.
- ✗
Disable the guest account on the file server.
Why it's wrong here
Disabling the guest account on the file server is a fundamental security practice that prevents anonymous, unauthenticated access to shared resources. This ensures that anyone attempting to access the file server must provide valid user credentials. However, this measure only enforces user authentication and does not impose any restrictions based on the specific hardware device (laptop) being used to initiate the connection. It does not prevent an authenticated user from accessing the server from an unauthorized laptop.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This 220-1202 question is part of Courseiva's 495-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.