N10-009 Network Security Practice Question
A network engineer is deploying 802.1X authentication for a wireless network. The security policy requires mutual authentication between the client and the network using certificates on both ends. Which EAP method should the engineer select?
⚠ Common exam trap
CompTIA often tests the distinction between EAP methods that use certificates on both ends versus those that use certificates only on the server side, leading candidates to mistakenly choose PEAP or EAP-FAST when the question explicitly requires mutual certificate authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EAP-TLS
EAP-TLS (Transport Layer Security) is the correct choice because it provides mutual authentication using certificates on both the client and the server, satisfying the security policy requirement. Unlike other EAP methods, EAP-TLS requires a PKI with certificates installed on both endpoints, ensuring that each side validates the other's identity before establishing the connection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
EAP-MD5
Why it's wrong here
EAP-MD5 is a rudimentary password-based challenge-response protocol that lacks robust security features. It authenticates only the client to the server, failing to provide mutual authentication, which leaves clients vulnerable to rogue access points and man-in-the-middle attacks. Furthermore, it does not support digital certificates and relies on the weak MD5 hashing algorithm, making it susceptible to dictionary attacks against captured password hashes.
- ✓
EAP-TLS
Why this is correct
EAP-TLS (Transport Layer Security) is considered one of the strongest EAP methods due to its comprehensive use of X.509 digital certificates. It requires both the authentication server (e.g., RADIUS) and the client device (supplicant) to present valid certificates, establishing robust mutual authentication. This process creates a highly secure, encrypted TLS tunnel for all subsequent communication, effectively preventing man-in-the-middle attacks and ensuring the identity of both parties.
- ✗
PEAP
Why it's wrong here
PEAP (Protected Extensible Authentication Protocol) addresses some of the weaknesses of older EAP methods by establishing a secure TLS tunnel using only a server-side certificate. This tunnel protects the subsequent, often less secure, inner authentication method (such as MS-CHAPv2 or GTC) used to authenticate the client's username and password. While PEAP protects client credentials from eavesdropping, it does not provide true certificate-based mutual authentication for the client, as the client's identity is typically verified via username/password within the encrypted tunnel, not by a client certificate.
When this WOULD be correct
A network engineer needs to deploy 802.1X authentication on a wireless network where the client does not have a certificate, but the server does. The security policy requires strong authentication with server-side certificate validation and support for legacy password-based client authentication.
- ✗
EAP-FAST
Why it's wrong here
EAP-FAST (Flexible Authentication via Secure Tunneling) was developed as a replacement for LEAP, offering a secure alternative without requiring client-side certificates. It relies on Protected Access Credentials (PACs), which are shared secrets provisioned to clients, to establish a secure tunnel. While EAP-FAST provides mutual authentication and protects user credentials within the tunnel, its security relies on the secure distribution and management of PACs rather than the more robust and widely trusted public key infrastructure (PKI) of client certificates.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓EAP-TLSCorrect answer▾
Why this is correct
EAP-TLS (Transport Layer Security) is considered one of the strongest EAP methods due to its comprehensive use of X.509 digital certificates. It requires both the authentication server (e.g., RADIUS) and the client device (supplicant) to present valid certificates, establishing robust mutual authentication. This process creates a highly secure, encrypted TLS tunnel for all subsequent communication, effectively preventing man-in-the-middle attacks and ensuring the identity of both parties.
✗PEAPWrong answer — click to see why▾
Why this is wrong here
PEAP uses a server-side certificate to create a TLS tunnel, but it does not require a client certificate for mutual authentication; it relies on inner EAP methods like MS-CHAPv2 for client authentication, which does not meet the requirement for certificates on both ends.
★ When this WOULD be the correct answer
A network engineer needs to deploy 802.1X authentication on a wireless network where the client does not have a certificate, but the server does. The security policy requires strong authentication with server-side certificate validation and support for legacy password-based client authentication.
Why candidates choose this
Candidates may confuse PEAP's use of a server certificate for tunnel establishment as satisfying mutual certificate authentication, not realizing that the client side typically uses passwords or other non-certificate methods inside the tunnel.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
802.1X
802.1X is a network access control standard that authenticates devices before they are allowed to connect to a wired or wireless network.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.