N10-009 Network Security Practice Question
A company wants to deploy a wireless network with the highest level of security for client authentication. The network will use a RADIUS server. Which authentication method should be used?
⚠ Common exam trap
Candidates often confuse PEAP with EAP-TLS because both use TLS, but PEAP only authenticates the server with a certificate while the client authenticates with a password (e.g., MSCHAPv2), making it less secure than full mutual certificate authentication in EAP-TLS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
802.1X with EAP-TLS
802.1X with EAP-TLS provides certificate-based mutual authentication, eliminating the risk of credential theft or dictionary attacks. This is the strongest authentication method for enterprise wireless networks, as it requires both the client and the RADIUS server to present valid X.509 certificates, ensuring a cryptographically verified identity on both sides.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
WPA2-PSK
Why it's wrong here
WPA2-PSK (Pre-Shared Key) relies on a single, static passphrase shared among all users on the network. This method lacks individual user accountability and makes key management difficult and insecure in larger organizations. If the pre-shared key is compromised, all network security is jeopardized, rendering it unsuitable for enterprise-grade security where granular access control and robust per-user authentication are paramount.
When this WOULD be correct
In a small office or home network where simplicity is key and no RADIUS server is available, WPA2-PSK would be the correct choice for securing the wireless network.
- ✗
WPA3-SAE
Why it's wrong here
WPA3-SAE (Simultaneous Authentication of Equals) significantly enhances security over WPA2-PSK by providing stronger key establishment and protection against offline dictionary attacks. However, SAE is primarily designed for WPA3-Personal networks, which use a pre-shared key model and do not typically integrate with a RADIUS server for centralized, per-user authentication. Therefore, it does not offer the enterprise-level authentication and granular access control required for the highest security in large organizations.
When this WOULD be correct
A company wants to deploy a wireless network with the highest level of security for client authentication but does not have a RADIUS server and prefers a password-based method.
- ✓
802.1X with EAP-TLS
Why this is correct
802.1X with EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) offers the highest level of wireless security by implementing robust mutual authentication. Both the client device and the authentication server (typically a RADIUS server) must present and validate digital certificates, ensuring that only trusted devices connect to a legitimate network. This certificate-based approach eliminates password vulnerabilities and provides strong identity verification, making it ideal for highly secure enterprise environments despite its configuration complexity.
- ✗
802.1X with PEAP
Why it's wrong here
802.1X with PEAP (Protected Extensible Authentication Protocol) establishes a TLS tunnel using a server-side certificate to protect the client's authentication credentials, typically a username and password. While it prevents eavesdropping on these credentials, PEAP does not require client-side certificates for mutual authentication. This makes it less robust than EAP-TLS, as the client's identity is verified solely through credentials rather than a cryptographic certificate, offering a slightly lower security posture.
When this WOULD be correct
A company wants to deploy a wireless network with strong security but without the complexity of managing client certificates. The network uses a RADIUS server and requires user password-based authentication with server-side certificate validation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓802.1X with EAP-TLSCorrect answer▾
Why this is correct
802.1X with EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) offers the highest level of wireless security by implementing robust mutual authentication. Both the client device and the authentication server (typically a RADIUS server) must present and validate digital certificates, ensuring that only trusted devices connect to a legitimate network. This certificate-based approach eliminates password vulnerabilities and provides strong identity verification, making it ideal for highly secure enterprise environments despite its configuration complexity.
✗WPA2-PSKWrong answer — click to see why▾
Why this is wrong here
WPA2-PSK uses a pre-shared key for authentication, not a RADIUS server, so it does not meet the requirement for the highest level of security with RADIUS-based client authentication.
★ When this WOULD be the correct answer
In a small office or home network where simplicity is key and no RADIUS server is available, WPA2-PSK would be the correct choice for securing the wireless network.
Why candidates choose this
Candidates may be familiar with WPA2-PSK as a common security method and overlook the specific requirement for RADIUS server integration and highest security.
✗WPA3-SAEWrong answer — click to see why▾
Why this is wrong here
WPA3-SAE is a personal authentication method that does not use a RADIUS server; it relies on a pre-shared key (PSK) for client authentication, not 802.1X or EAP.
★ When this WOULD be the correct answer
A company wants to deploy a wireless network with the highest level of security for client authentication but does not have a RADIUS server and prefers a password-based method.
Why candidates choose this
Candidates may confuse WPA3-SAE as the highest security standard overall, overlooking that the question specifies RADIUS server usage, which requires enterprise authentication like 802.1X.
✗802.1X with PEAPWrong answer — click to see why▾
Why this is wrong here
PEAP uses a server-side certificate only, not requiring client certificates, which provides lower security than EAP-TLS. The question specifies the highest level of security, so EAP-TLS with mutual certificate authentication is required.
★ When this WOULD be the correct answer
A company wants to deploy a wireless network with strong security but without the complexity of managing client certificates. The network uses a RADIUS server and requires user password-based authentication with server-side certificate validation.
Why candidates choose this
Candidates may confuse PEAP with EAP-TLS, thinking both offer similar security, or they may believe PEAP's use of passwords is sufficient for 'highest security' when it is not.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
EAP
EAP is a flexible authentication framework used in network access control, supporting multiple methods like passwords, certificates, and tokens.
Key term
RADIUS
RADIUS is a network protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.