N10-009 Network Security Practice Question
A company's wireless network currently uses WPA2-PSK with a shared passphrase. A security audit identifies that the passphrase is weak and shared among all employees. Which of the following would provide the MOST secure wireless access while addressing the shared passphrase issue?
⚠ Common exam trap
It's easy for candidates to assume upgrading to WPA3-Personal (with SAE) is sufficient, but the question specifically requires addressing the 'shared passphrase' issue, which only per-user authentication (802.1X) can solve.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement WPA2-Enterprise with 802.1X
WPA2-Enterprise with 802.1X eliminates the shared passphrase by using a RADIUS server to authenticate each user individually, typically via EAP methods such as PEAP or EAP-TLS. This provides per-user credentials (e.g., username/password or certificates), so compromising one user's credentials does not expose the entire network. It also supports dynamic per-session encryption keys, making it far more secure than any shared-passphrase solution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement WPA2-Enterprise with 802.1X
Why this is correct
Implementing WPA2-Enterprise with 802.1X is the most robust solution for a corporate environment. This method leverages a centralized authentication server, typically RADIUS, to authenticate individual users or devices using unique credentials, rather than a single shared key. It provides dynamic, per-user encryption keys and strong access control, significantly mitigating the risks associated with a compromised shared passphrase by ensuring individual accountability and secure key distribution.
- ✗
Upgrade to WPA3-Personal with a strong passphrase
Why it's wrong here
Upgrading to WPA3-Personal, while offering improved cryptographic strength and protection against offline dictionary attacks through Simultaneous Authentication of Equals (SAE), still fundamentally relies on a single pre-shared passphrase. If this passphrase is leaked or compromised, the entire network's security is at risk, as it remains a single point of failure for all users. It does not provide the individual user authentication and accountability required for enterprise-level security.
When this WOULD be correct
If the question asked for the most secure wireless access for a small office/home office (SOHO) environment where 802.1X infrastructure is unavailable, and the primary concern was protecting against brute-force attacks on the passphrase, then upgrading to WPA3-Personal with a strong passphrase would be the best option.
- ✗
Disable SSID broadcast
Why it's wrong here
Disabling SSID broadcast attempts to hide the network name from casual observation, but it is a weak security measure easily circumvented by readily available network scanning tools. This practice does not enhance the underlying authentication or encryption protocols in any way, nor does it prevent an attacker from discovering and potentially exploiting vulnerabilities once the network's presence is detected. It offers no real protection against determined attackers.
When this WOULD be correct
A question asks for a method to reduce casual unauthorized access attempts or network discovery, with no requirement to address authentication weaknesses. For example: 'Which of the following would make a wireless network less visible to casual users?'
- ✗
Enable MAC address filtering
Why it's wrong here
Enabling MAC address filtering is a superficial security control that restricts network access based on a device's hardware address. However, MAC addresses are easily spoofed by attackers using common network utilities, rendering this method ineffective as a primary security barrier. Furthermore, MAC filtering does not provide any form of encryption or strong authentication for the wireless traffic itself, nor does it address the fundamental vulnerability of a shared passphrase.
When this WOULD be correct
When the question asks for a method to prevent unauthorized devices from connecting to a small, static network where device control is feasible, and the primary concern is not authentication strength but basic access restriction.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Implement WPA2-Enterprise with 802.1XCorrect answer▾
Why this is correct
Implementing WPA2-Enterprise with 802.1X is the most robust solution for a corporate environment. This method leverages a centralized authentication server, typically RADIUS, to authenticate individual users or devices using unique credentials, rather than a single shared key. It provides dynamic, per-user encryption keys and strong access control, significantly mitigating the risks associated with a compromised shared passphrase by ensuring individual accountability and secure key distribution.
✗Upgrade to WPA3-Personal with a strong passphraseWrong answer — click to see why▾
Why this is wrong here
WPA3-Personal still uses a shared passphrase, which does not address the security audit's finding that the passphrase is shared among all employees. The goal is to eliminate the shared passphrase, not just strengthen it.
★ When this WOULD be the correct answer
If the question asked for the most secure wireless access for a small office/home office (SOHO) environment where 802.1X infrastructure is unavailable, and the primary concern was protecting against brute-force attacks on the passphrase, then upgrading to WPA3-Personal with a strong passphrase would be the best option.
Why candidates choose this
Candidates may think that upgrading to a newer, more secure protocol (WPA3) automatically solves all security issues, overlooking that WPA3-Personal still relies on a shared passphrase, which is the core problem identified in the audit.
✗Disable SSID broadcastWrong answer — click to see why▾
Why this is wrong here
Disabling SSID broadcast only hides the network name from beacon frames, but the weak shared passphrase remains unchanged, so it does not address the core security issue of shared credentials.
★ When this WOULD be the correct answer
A question asks for a method to reduce casual unauthorized access attempts or network discovery, with no requirement to address authentication weaknesses. For example: 'Which of the following would make a wireless network less visible to casual users?'
Why candidates choose this
Candidates may think hiding the SSID adds a layer of security by making the network 'invisible,' but it is easily bypassed and does not fix authentication flaws.
✗Enable MAC address filteringWrong answer — click to see why▾
Why this is wrong here
MAC address filtering does not address the shared passphrase issue; it only restricts access based on device MAC addresses, which can be spoofed and does not improve authentication security.
★ When this WOULD be the correct answer
When the question asks for a method to prevent unauthorized devices from connecting to a small, static network where device control is feasible, and the primary concern is not authentication strength but basic access restriction.
Why candidates choose this
Candidates may think MAC filtering adds a layer of security by allowing only approved devices, overlooking that it is easily bypassed and does not solve the weak shared passphrase problem.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
PSK
A pre-shared key (PSK) is a secret string of characters shared in advance between two parties to authenticate and encrypt wireless or VPN communications.
Key term
802.1X
802.1X is a network access control standard that authenticates devices before they are allowed to connect to a wired or wireless network.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.