N10-009 Network Implementation Practice Question
A company has deployed a WPA2-Enterprise wireless network. Users report that they cannot authenticate. The RADIUS server logs show that authentication attempts are received but no responses are sent back to the wireless controller. The wireless controller and RADIUS server are on different subnets, separated by a firewall. Which of the following is the MOST likely cause?
⚠ Common exam trap
Many candidates assume the issue is with client configuration (EAP method) or layer 2 connectivity (broadcast domain), when the symptom of 'requests received but no responses sent' points directly to a firewall blocking the return path, a classic network-layer troubleshooting scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall is blocking RADIUS traffic on UDP ports 1812 and 1813.
The RADIUS server logs show authentication attempts are received but no responses are sent back, indicating the request reached the server but the reply is being dropped. Since the wireless controller and RADIUS server are on different subnets separated by a firewall, the most likely cause is that the firewall is blocking the return RADIUS traffic. RADIUS uses UDP ports 1812 for authentication and 1813 for accounting, and these must be open in both directions for successful communication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The wireless clients do not support the correct EAP method.
Why it's wrong here
Should wireless clients lack support for the specific Extensible Authentication Protocol (EAP) method mandated by the WPA2-Enterprise network, the authentication process would still commence. The RADIUS server would receive the client's initial EAP messages and, upon determining the unsupported method, would typically respond with an EAP-Failure or Access-Reject message. The problem describes a situation where users *cannot* authenticate, suggesting a lack of communication or response altogether, rather than an explicit rejection due to a protocol mismatch.
When this WOULD be correct
This would be correct in a scenario where users cannot authenticate and the RADIUS server logs show no authentication attempts at all, or show errors indicating unsupported EAP types. For example, if clients are configured for PEAP but the server only supports EAP-TLS.
- ✓
The firewall is blocking RADIUS traffic on UDP ports 1812 and 1813.
Why this is correct
WPA2-Enterprise networks rely on RADIUS (Remote Authentication Dial-In User Service) for centralized authentication, with the wireless controller acting as a RADIUS client. RADIUS primarily uses UDP ports 1812 for authentication and 1813 for accounting. If a firewall positioned between the wireless controller and the RADIUS server is configured to block traffic on these specific UDP ports, authentication requests or responses will be dropped. This prevents the RADIUS server from validating user credentials or returning an Access-Accept/Reject message, resulting in authentication timeouts and users being unable to connect to the network.
- ✗
The RADIUS server is not in the same broadcast domain as the wireless controller.
Why it's wrong here
RADIUS is an application-layer protocol that operates over IP, typically utilizing UDP for its transport. It is not constrained by Layer 2 broadcast domains. Network routers are specifically designed to forward IP packets between different subnets and broadcast domains. Therefore, as long as there is proper IP routing and connectivity established between the wireless controller and the RADIUS server, they can communicate effectively, regardless of whether they reside in the same broadcast segment.
When this WOULD be correct
In a scenario where the wireless controller and RADIUS server are on the same subnet but authentication fails, and the issue is that the controller cannot discover the RADIUS server via broadcast (e.g., using a non-IP-based protocol or misconfigured service location).
- ✗
The SSID is not being broadcast.
Why it's wrong here
If the Service Set Identifier (SSID) were not being broadcast, wireless clients would be unable to discover or even see the network listed in their available networks. Users would not be able to initiate an authentication attempt if they couldn't first identify and select the network. The scenario implies users are actively trying to authenticate, indicating they have successfully discovered the network, making SSID broadcast status irrelevant to their authentication failure.
When this WOULD be correct
In a scenario where users report they cannot see the wireless network in their available networks list, and the network is configured not to broadcast the SSID, then the SSID not being broadcast would be the correct answer. This would be a different question focusing on network discovery rather than authentication failures.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓The firewall is blocking RADIUS traffic on UDP ports 1812 and 1813.Correct answer▾
Why this is correct
WPA2-Enterprise networks rely on RADIUS (Remote Authentication Dial-In User Service) for centralized authentication, with the wireless controller acting as a RADIUS client. RADIUS primarily uses UDP ports 1812 for authentication and 1813 for accounting. If a firewall positioned between the wireless controller and the RADIUS server is configured to block traffic on these specific UDP ports, authentication requests or responses will be dropped. This prevents the RADIUS server from validating user credentials or returning an Access-Accept/Reject message, resulting in authentication timeouts and users being unable to connect to the network.
✗The wireless clients do not support the correct EAP method.Wrong answer — click to see why▾
Why this is wrong here
The RADIUS server logs show authentication attempts are received, indicating the wireless clients' EAP methods are successfully reaching the server. The issue is that no responses are sent back, which points to a network connectivity problem, not client-side EAP support.
★ When this WOULD be the correct answer
This would be correct in a scenario where users cannot authenticate and the RADIUS server logs show no authentication attempts at all, or show errors indicating unsupported EAP types. For example, if clients are configured for PEAP but the server only supports EAP-TLS.
Why candidates choose this
Candidates may confuse client-side EAP configuration issues with server-side response failures, especially when the symptom is 'cannot authenticate' without considering where in the authentication flow the failure occurs.
✗The RADIUS server is not in the same broadcast domain as the wireless controller.Wrong answer — click to see why▾
Why this is wrong here
The RADIUS server logs show authentication attempts are received, indicating the wireless controller can reach the RADIUS server. Being in the same broadcast domain is not required for RADIUS, which operates at Layer 3 and can traverse routers.
★ When this WOULD be the correct answer
In a scenario where the wireless controller and RADIUS server are on the same subnet but authentication fails, and the issue is that the controller cannot discover the RADIUS server via broadcast (e.g., using a non-IP-based protocol or misconfigured service location).
Why candidates choose this
Candidates may confuse the need for Layer 2 connectivity (broadcast domain) with Layer 3 reachability, especially when troubleshooting network segmentation issues.
✗The SSID is not being broadcast.Wrong answer — click to see why▾
Why this is wrong here
The SSID not being broadcast prevents clients from seeing the network in their scan lists, but the RADIUS server logs show authentication attempts are received, indicating clients are already attempting to connect. The issue is that no responses are sent back, pointing to a network path problem, not SSID visibility.
★ When this WOULD be the correct answer
In a scenario where users report they cannot see the wireless network in their available networks list, and the network is configured not to broadcast the SSID, then the SSID not being broadcast would be the correct answer. This would be a different question focusing on network discovery rather than authentication failures.
Why candidates choose this
Candidates may confuse authentication issues with network visibility problems, assuming that if users cannot authenticate, the SSID might not be visible, even though the logs show authentication attempts are reaching the RADIUS server.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Wireless Standards and Configuration
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Controller
A controller is a hardware chip or software program that manages data flow and communication between a computer's operating system and its connected devices or networks.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.