mediumMultiple ChoiceObjective-mapped
220-1202 Practice Question: A user's laptop running Windows 10 Pro connects…
A user's laptop running Windows 10 Pro connects to the corporate Wi-Fi but cannot access internal resources. The network uses WPA2-Enterprise with PEAP-MSCHAPv2. The laptop's wireless profile is configured correctly. Other users in the same office can access resources. What is the most likely cause?
⚠ Common exam trap
The 220-1202 exam often tests the distinction between Layer 2 association and Layer 3 authentication; the trap here is that candidates assume a successful Wi-Fi connection implies full network access, overlooking that WPA2-Enterprise requires valid domain credentials for RADIUS-based authentication to grant access to internal resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user's domain account is locked or the password has expired.
The user can connect to Wi-Fi but cannot access internal resources, and other users are unaffected. Since the wireless profile is correct and WPA2-Enterprise uses PEAP-MSCHAPv2 for authentication, the most likely cause is that the user's domain account is locked or the password has expired. This would prevent successful authentication against the RADIUS server, blocking access to internal resources even though the client associates with the access point.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The laptop's wireless adapter is faulty.
Why it's wrong here
If the wireless adapter were truly faulty, the laptop would likely be unable to detect any available Wi-Fi networks, associate with an access point, or maintain a stable connection at all. Since the user can connect to the Wi-Fi, it indicates the adapter is functioning sufficiently to establish the physical layer connection. The problem, therefore, lies further up the network stack, beyond the basic hardware functionality of the adapter itself.
- ✓
The user's domain account is locked or the password has expired.
Why this is correct
In an enterprise environment, Wi-Fi authentication often leverages 802.1X, which typically uses protocols like PEAP-MSCHAPv2 to validate user credentials against a central directory service, such as Active Directory. If the user's domain account is locked or their password has expired, the authentication server (e.g., a RADIUS server) will reject the authentication request. This prevents the user from gaining full network access and obtaining a valid IP address, even if the laptop successfully associates with the access point's signal.
- ✗
The access point is broadcasting on a congested channel.
Why it's wrong here
Channel congestion, which occurs when multiple wireless devices or access points operate on the same frequency, primarily causes performance degradation such as slow data transfer speeds, high latency, or intermittent disconnections. While it severely impacts usability, it would not typically prevent a device from successfully authenticating to the network and obtaining an IP address. The user would still be technically "on" the network, albeit with severely impaired performance, rather than a complete inability to access resources.
- ✗
The laptop has an incorrect IP address from DHCP.
Why it's wrong here
While an incorrect or APIPA (169.254.x.x) IP address would certainly prevent access to network resources beyond the local subnet, the prompt states the user "connects to" the Wi-Fi. This implies successful association and potentially authentication, which usually precedes a DHCP lease. If other users are functioning correctly, a widespread DHCP server misconfiguration is less likely. Often, an authentication failure (as in the correct option) can prevent a device from even receiving a valid DHCP lease, making the authentication issue the more fundamental problem.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.