hardMultiple ChoiceObjective-mapped
WPA2-Enterprise RADIUS Authentication
A network administrator is deploying a new wireless network that requires users to authenticate using their domain credentials. The network uses WPA2-Enterprise. Which service must be configured to validate these credentials?
Quick Answer
The correct answer is RADIUS. WPA2-Enterprise relies on the 802.1X authentication framework, which requires a central authentication server to validate user credentials; RADIUS is the service that performs this role, typically checking domain credentials against Active Directory. On the CompTIA A+ Core 1 220-1201 exam, this concept tests your understanding of enterprise wireless security—specifically that WPA2-Enterprise uses 802.1X and RADIUS together, while WPA2-Personal uses a pre-shared key. A common trap is confusing RADIUS with DHCP or DNS, but remember that DHCP assigns IP addresses, DNS resolves names, and NTP syncs time—none handle authentication. To lock it in, use the mnemonic: “RADIUS Rules Authentication, DHCP Does IPs, DNS Does Names.”
⚠ Common exam trap
It's easy for candidates to confuse RADIUS with DHCP or DNS because they associate 'domain credentials' with Active Directory, but they forget that RADIUS is the service that actually performs the authentication handshake in an 802.1X environment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RADIUS
WPA2-Enterprise uses 802.1X authentication, which requires a RADIUS server to validate domain credentials against an authentication backend such as Active Directory. The RADIUS server acts as the Authentication Server (AS) in the 802.1X framework, receiving EAP packets from the access point and verifying the user's credentials before granting network access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DHCP
Why it's wrong here
DHCP assigns IP addresses, not authentication.
- ✗
DNS
Why it's wrong here
DNS resolves names, not credentials.
- ✓
RADIUS
Why this is correct
RADIUS authenticates users for network access, commonly used with 802.1X.
- ✗
NTP
Why it's wrong here
NTP synchronizes time, not authentication.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Network Configuration: IP, DNS, DHCP
Key term
Access Point
An access point is a device that creates a wireless local area network, usually by connecting to a wired network and broadcasting a Wi-Fi signal for computers, phones, and tablets to join.
Key term
WPA2
WPA2 is a security protocol used to protect Wi-Fi networks by encrypting data transmitted between devices and the access point.
About these practice questions
Courseiva writes every 220-1201 question from scratch — 972 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 220-1201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A user complains that their laptop cannot connect to the company's wireless network, but other devices work fine. The network uses WPA2-Enterprise with 802.1X authentication. Which service is most likely misconfigured on the laptop?
medium- A.The DHCP server is out of addresses.
- B.The DNS server address is incorrect.
- C.The RADIUS server is offline.
- ✓ D.The 802.1X authentication method is set to PEAP instead of EAP-TLS.
Why D: WPA2-Enterprise with 802.1X authentication requires the laptop to use a supplicant configured with the correct EAP method that matches the RADIUS server. If the laptop is set to PEAP (which uses a username/password or certificate) but the network requires EAP-TLS (which mandates client certificates), authentication will fail, preventing the laptop from connecting even though other devices with the correct configuration work fine.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1201 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1201 exam.