hardMultiple ChoiceObjective-mapped
220-1202 Practice Question: A technician is troubleshooting an Android device…
A technician is troubleshooting an Android device that is unable to connect to a corporate Wi-Fi network using WPA2-Enterprise with a username and password. The device connects successfully to other open Wi-Fi networks. Which Android setting should the technician check first to resolve the authentication failure?
⚠ Common exam trap
A common trap is that candidates think credential issues (wrong username/password) are the primary cause of WPA2-Enterprise failures, but the real issue is that Android requires explicit CA certificate selection for enterprise networks, unlike some other OSes that may use system certificates automatically.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check if a CA certificate is installed and selected in the Wi-Fi network's advanced settings.
WPA2-Enterprise with username/password authentication typically requires a CA certificate to validate the RADIUS server's identity. Without a trusted CA certificate installed and selected in the Wi-Fi network's advanced security settings, the Android device will reject the connection attempt, even though the credentials are correct. This is the most common cause of authentication failure in enterprise Wi-Fi environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Verify that the device's IP address is set to DHCP.
Why it's wrong here
802.1X authentication occurs at the data link layer (Layer 2) of the OSI model, establishing a secure connection before the device can even request or be assigned an IP address. Whether the device is configured for DHCP or a static IP address is a Layer 3 (network layer) concern. Therefore, verifying DHCP settings would not resolve an authentication failure, as the device hasn't reached the stage where IP address assignment is relevant.
- ✓
Check if a CA certificate is installed and selected in the Wi-Fi network's advanced settings.
Why this is correct
In WPA2-Enterprise (802.1X) networks, a Certificate Authority (CA) certificate is essential for the client device to verify the authenticity of the RADIUS authentication server. This server validation prevents man-in-the-middle attacks by ensuring the client is communicating with a legitimate network component. If the required CA certificate is not installed on the Android device or is not correctly selected within the Wi-Fi network's advanced EAP settings, the authentication process will fail, preventing network access.
- ✗
Disable the proxy settings for that Wi-Fi network.
Why it's wrong here
Proxy settings primarily affect how a device routes application-layer traffic, such as HTTP/HTTPS requests, *after* a network connection has been successfully established and an IP address obtained. 802.1X authentication, however, operates at the data link layer (Layer 2) to establish the initial network connection. Disabling proxy settings would not resolve an authentication failure because the device cannot even reach the stage where proxy configurations would become relevant for web traffic.
- ✗
Configure a static MAC address on the device.
Why it's wrong here
Configuring a static MAC address on a device is generally unrelated to 802.1X authentication, which relies on user or machine credentials and certificates. While MAC filtering can restrict network access based on MAC addresses, it is a separate security mechanism from 802.1X and typically occurs *before* or in conjunction with other authentication methods. An 802.1X authentication failure specifically points to issues with credentials, certificates, or the authentication server, not the device's MAC address configuration.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 495 original 220-1202 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.