Question 466 of 750

Remote Access Technologies →hardMultiple ChoiceObjective-mapped

Quick Answer

The answer is that certificate-based authentication provides mutual authentication and unique per-device identity, which is the primary security advantage over a pre-shared key. While a PSK is a single shared secret that, if compromised, exposes the entire VPN to unauthorized access, each certificate is issued by a trusted Certificate Authority and tied to a specific device, so a breach of one certificate does not compromise the whole infrastructure. On the CompTIA A+ Core 2 220-1202 exam, this concept tests your understanding of authentication strength and the principle of least privilege—a common trap is assuming PSK is equally secure because both authenticate, but the key difference is mutual verification and reduced blast radius. Remember the memory tip: “PSK is a master key to every door; a certificate is a unique key for just one lock.”

220-1102 Remote Access Technologies Practice Question

This 220-1202 practice question tests your understanding of remote access technologies. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A security audit reveals that a company's remote access solution uses a VPN with pre-shared keys (PSK) for authentication. The auditor recommends upgrading to certificate-based authentication. Which of the following is the primary security advantage of certificate-based authentication over PSK?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "primary"
Why it matters: Asks for the main purpose or function, not a secondary benefit. Eliminate answers that describe side-effects or partial functions.

Question 1hardmultiple choice

Read the full VPN explanation →

A
Certificates are easier to configure and manage than PSK.
Why wrong: Certificates are actually more complex to set up, requiring a PKI, but they offer better security. Ease of management is not the primary advantage.
B
Certificates provide mutual authentication and are unique per device, reducing the risk of a single compromised key affecting all users.
Each certificate is unique and can be revoked individually. If a device is lost, only that certificate needs to be revoked, unlike PSK where the shared key must be changed for everyone.
C
Certificates eliminate the need for a VPN server.
Why wrong: Certificates are used for authentication within a VPN; they do not replace the VPN server itself.
D
Certificates are faster than PSK for establishing VPN connections.
Why wrong: Certificate-based authentication involves more computational overhead (asymmetric encryption) and is generally slower than PSK, but the security benefit outweighs the speed difference.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Certificates provide mutual authentication and are unique per device, reducing the risk of a single compromised key affecting all users.

Certificate-based authentication provides mutual authentication, meaning both the VPN client and server verify each other's identity using digital certificates issued by a trusted Certificate Authority (CA). Unlike PSK, which is a shared secret that can be leaked and reused across all devices, each certificate is unique per device, so compromise of one certificate does not expose the entire VPN infrastructure. This significantly reduces the blast radius of a security breach and aligns with the principle of least privilege.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Certificates are easier to configure and manage than PSK.
Why it's wrong here
Certificates are actually more complex to set up, requiring a PKI, but they offer better security. Ease of management is not the primary advantage.
✓
Certificates provide mutual authentication and are unique per device, reducing the risk of a single compromised key affecting all users.
Why this is correct
Each certificate is unique and can be revoked individually. If a device is lost, only that certificate needs to be revoked, unlike PSK where the shared key must be changed for everyone.
Clue confirmation
The clue word "primary" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Certificates eliminate the need for a VPN server.
Why it's wrong here
Certificates are used for authentication within a VPN; they do not replace the VPN server itself.
✗
Certificates are faster than PSK for establishing VPN connections.
Why it's wrong here
Certificate-based authentication involves more computational overhead (asymmetric encryption) and is generally slower than PSK, but the security benefit outweighs the speed difference.

Common exam traps

Common exam trap: answer the scenario, not the keyword

CompTIA often tests the misconception that certificates are 'easier' or 'faster' than PSK, when in reality the primary security advantage is mutual authentication and per-device uniqueness, not operational simplicity or performance.

Detailed technical explanation

How to think about this question

In IPsec VPNs, PSK uses a single symmetric key for IKE Phase 1 authentication, which is vulnerable to offline dictionary attacks if the PSK is weak. Certificate-based authentication leverages asymmetric cryptography (RSA or ECDSA) and X.509 certificates, enabling Perfect Forward Secrecy (PFS) and non-repudiation. In a real-world scenario, if an employee's laptop is stolen, the IT admin can revoke only that device's certificate via CRL or OCSP, while all other devices remain secure; with PSK, the entire VPN would need to be rekeyed.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related 220-1202 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Windows OS Features and Tools practice questions

Practise 220-1202 questions linked to Windows OS Features and Tools.

Windows Settings and Control Panel practice questions

Practise 220-1202 questions linked to Windows Settings and Control Panel.

Windows Command-Line Tools practice questions

Practise 220-1202 questions linked to Windows Command-Line Tools.

Windows Administrative Tools practice questions

Practise 220-1202 questions linked to Windows Administrative Tools.

macOS Features and Tools practice questions

Practise 220-1202 questions linked to macOS Features and Tools.

Linux Commands and File Permissions practice questions

Practise 220-1202 questions linked to Linux Commands and File Permissions.

Mobile OS Features and Tools practice questions

Practise 220-1202 questions linked to Mobile OS Features and Tools.

Virtualization and Cloud Technologies practice questions

Practise 220-1202 questions linked to Virtualization and Cloud Technologies.

Physical Security Controls practice questions

Practise 220-1202 questions linked to Physical Security Controls.

Logical Security Concepts practice questions

Practise 220-1202 questions linked to Logical Security Concepts.

Wireless Security Protocols practice questions

Practise 220-1202 questions linked to Wireless Security Protocols.

Malware Types and Removal practice questions

Practise 220-1202 questions linked to Malware Types and Removal.

Practice this exam

Start a free 220-1202 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

220-1202 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this 220-1202 question test?

Remote Access Technologies — This question tests Remote Access Technologies — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Certificates provide mutual authentication and are unique per device, reducing the risk of a single compromised key affecting all users. — Certificate-based authentication provides mutual authentication, meaning both the VPN client and server verify each other's identity using digital certificates issued by a trusted Certificate Authority (CA). Unlike PSK, which is a shared secret that can be leaked and reused across all devices, each certificate is unique per device, so compromise of one certificate does not expose the entire VPN infrastructure. This significantly reduces the blast radius of a security breach and aligns with the principle of least privilege.

What should I do if I get this 220-1202 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "primary". Asks for the main purpose or function, not a secondary benefit. Eliminate answers that describe side-effects or partial functions.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.