CAS-004 Security Engineering Practice Question
A security engineer is configuring a wireless network for a corporate office. The network must support 802.1X authentication with EAP-TLS, and the engineer wants to ensure that only devices with valid certificates issued by the corporate CA can connect. Which of the following should the engineer configure on the RADIUS server to enforce this requirement?
⚠ Common exam trap
The trap here is assuming that any 802.1X method with strong encryption, like PEAP or EAP-TTLS, can enforce device certificate authentication, when only EAP-TLS requires client certificates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure EAP-TLS and validate client certificates against the corporate CA.
EAP-TLS is the only method that mandates client-side certificates, allowing the RADIUS server to validate them against the corporate CA. This ensures that only devices with certificates from that CA can connect. The other methods either rely on user credentials, tunneled legacy authentication, or PACs, none of which enforce device certificate validation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure EAP-TLS and validate client certificates against the corporate CA.
Why this is correct
EAP-TLS requires both the server and client to present certificates. By configuring the RADIUS server to trust only the corporate CA and to require client certificates, the engineer ensures that only devices with valid certificates issued by that CA can authenticate. This meets the requirement exactly and is considered the most secure EAP method.
- ✗
Enable PEAP with MSCHAPv2 and require domain credentials.
Why it's wrong here
PEAP with MSCHAPv2 authenticates users with username and password, not device certificates. It does not enforce certificate-based authentication for devices, so any device with valid user credentials could connect. This fails the requirement that only devices with certificates issued by the corporate CA can connect.
- ✗
Deploy EAP-FAST with PACs and require machine authentication.
Why it's wrong here
EAP-FAST uses a Protected Access Credential (PAC) for authentication, which can be provisioned to devices. However, PACs are not X.509 certificates and do not provide the same level of assurance as certificate-based authentication. While machine authentication can be enabled, it does not guarantee that the device has a certificate issued by the corporate CA.
- ✗
Implement EAP-TTLS with a tunneled authentication protocol and check user group membership.
Why it's wrong here
EAP-TTLS typically uses a server certificate to establish a tunnel and then authenticates the client with a legacy method like MSCHAPv2 or PAP. It does not require client certificates, so it cannot enforce device certificate validation. Checking user group membership does not ensure that the device itself has a valid certificate from the corporate CA.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.