Courseiva
mediumMultiple ChoiceObjective-mapped

220-1102 Practice Question: A user's laptop running Windows 10 Pro connects…

A user's laptop running Windows 10 Pro connects to the corporate Wi-Fi but cannot access internal resources. The network uses WPA2-Enterprise with PEAP-MSCHAPv2. The laptop's wireless profile is configured correctly. Other users in the same office can access resources. What is the most likely cause?

⚠ Common exam trap

The 220-1202 exam often tests the distinction between Layer 2 association and Layer 3 authentication; the trap here is that candidates assume a successful Wi-Fi connection implies full network access, overlooking that WPA2-Enterprise requires valid domain credentials for RADIUS-based authentication to grant access to internal resources.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

The user's domain account is locked or the password has expired.

The user can connect to Wi-Fi but cannot access internal resources, and other users are unaffected. Since the wireless profile is correct and WPA2-Enterprise uses PEAP-MSCHAPv2 for authentication, the most likely cause is that the user's domain account is locked or the password has expired. This would prevent successful authentication against the RADIUS server, blocking access to internal resources even though the client associates with the access point.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • The laptop's wireless adapter is faulty.

    Why it's wrong here

    If the wireless adapter were truly faulty, the laptop would likely be unable to detect any available Wi-Fi networks, associate with an access point, or maintain a stable connection at all. Since the user can connect to the Wi-Fi, it indicates the adapter is functioning sufficiently to establish the physical layer connection. The problem, therefore, lies further up the network stack, beyond the basic hardware functionality of the adapter itself.

  • The user's domain account is locked or the password has expired.

    Why this is correct

    In an enterprise environment, Wi-Fi authentication often leverages 802.1X, which typically uses protocols like PEAP-MSCHAPv2 to validate user credentials against a central directory service, such as Active Directory. If the user's domain account is locked or their password has expired, the authentication server (e.g., a RADIUS server) will reject the authentication request. This prevents the user from gaining full network access and obtaining a valid IP address, even if the laptop successfully associates with the access point's signal.

  • The access point is broadcasting on a congested channel.

    Why it's wrong here

    Channel congestion, which occurs when multiple wireless devices or access points operate on the same frequency, primarily causes performance degradation such as slow data transfer speeds, high latency, or intermittent disconnections. While it severely impacts usability, it would not typically prevent a device from successfully authenticating to the network and obtaining an IP address. The user would still be technically "on" the network, albeit with severely impaired performance, rather than a complete inability to access resources.

  • The laptop has an incorrect IP address from DHCP.

    Why it's wrong here

    While an incorrect or APIPA (169.254.x.x) IP address would certainly prevent access to network resources beyond the local subnet, the prompt states the user "connects to" the Wi-Fi. This implies successful association and potentially authentication, which usually precedes a DHCP lease. If other users are functioning correctly, a widespread DHCP server misconfiguration is less likely. Often, an authentication failure (as in the correct option) can prevent a device from even receiving a valid DHCP lease, making the authentication issue the more fundamental problem.

Quick reference

AAA Protocol Comparison

ProtocolPort(s)EncryptionTransportPrimary Use
RADIUS1812 / 1813Password onlyUDPNetwork access control
TACACS+49Full packetTCPDevice administration
Diameter3868Full sessionTCP / SCTPCarrier / mobile networks
802.1XEAP-basedLayer 2Port-based access control

TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.

About these practice questions

Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.