hardMultiple ChoiceObjective-mapped
220-1201 Practice Question: A technician is troubleshooting an Android phone…
A technician is troubleshooting an Android phone that fails to connect to a corporate Wi-Fi network using WPA2-Enterprise with PEAP. The phone connects to other Wi-Fi networks without issue. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to confuse PEAP (which requires a server certificate but not a client certificate) with EAP-TLS (which requires both), and incorrectly assume the issue is with the phone's date/time or a faulty adapter, rather than the missing CA certificate needed for the TLS tunnel.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The CA certificate for the network is not installed or trusted.
WPA2-Enterprise with PEAP requires the phone to validate the server's identity using a CA certificate. If the CA certificate is missing or untrusted, the EAP-TLS handshake fails, preventing connection even though the phone can connect to other (non-Enterprise) networks. This is the most common cause of such failures in corporate environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Wi-Fi adapter is faulty.
Why it's wrong here
If the Wi-Fi adapter were truly faulty, the Android phone would likely be unable to detect any Wi-Fi networks at all, or it would fail to connect to *any* network, regardless of its security type. A hardware malfunction typically manifests as a complete inability to utilize the Wi-Fi radio, rather than a specific authentication failure with an enterprise network. This scenario points towards a configuration or authentication issue, not a fundamental hardware defect.
- ✗
The phone's date and time are incorrect.
Why it's wrong here
While incorrect date and time settings can indeed lead to certificate validation failures, particularly if the certificate's validity period (notBefore/notAfter dates) cannot be accurately checked, this is a less frequent cause for WPA2-Enterprise connection issues compared to a completely missing or untrusted CA certificate. The system might reject a certificate if its validity period appears to be in the future or past due to a time sync error, but the primary barrier for enterprise networks is usually the absence of the root of trust itself.
- ✓
The CA certificate for the network is not installed or trusted.
Why this is correct
WPA2-Enterprise networks, often utilizing 802.1X with EAP-TLS or PEAP, rely on server-side certificates to authenticate the RADIUS server to the client device. If the Certificate Authority (CA) certificate that signed the RADIUS server's certificate is not installed on the Android phone or is not explicitly trusted by the device, the phone cannot verify the authenticity of the network's authentication server. This prevents the secure handshake required for connection, as the client cannot establish trust with the server and therefore cannot proceed with user authentication.
- ✗
The phone is using a static IP address.
Why it's wrong here
Configuring a static IP address on the Android phone would not typically prevent the initial connection or authentication process to a WPA2-Enterprise network. Instead, if the static IP address is outside the network's subnet, already in use by another device, or if the network expects DHCP, it would lead to IP address conflicts, network communication failures *after* a successful connection, or an inability to route traffic. The core issue of failing to *connect* to the network, especially one requiring enterprise authentication, is distinct from IP addressing problems.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
TCP/IP and Common Ports for A+
Key term
WPA2
WPA2 is a security protocol used to protect Wi-Fi networks by encrypting data transmitted between devices and the access point.
Key term
Android
Android is an open-source operating system used primarily on mobile devices like smartphones and tablets, developed by Google.
About these practice questions
One of 972 original 220-1201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1201 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1201 exam.