Question 94 of 464
N10-009 Network Implementation Practice Question
A network administrator is implementing a new wireless network that will use WPA2-Enterprise. Which of the following must be configured on the network to support this security method?
⚠ Common exam trap
Many exam-takers confuse WPA2-Enterprise with WPA2-Personal and assume a pre-shared key is required, or they overgeneralize the role of a certificate authority, thinking it is mandatory for all enterprise Wi-Fi deployments when it is only required for specific EAP methods like EAP-TLS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A RADIUS server
WPA2-Enterprise uses 802.1X authentication, which requires a RADIUS server to centralize authentication, authorization, and accounting (AAA). The RADIUS server validates user credentials (e.g., against Active Directory or LDAP) and distributes the Pairwise Master Key (PMK) to the access point, enabling per-user, per-session encryption keys. Without a RADIUS server, the enterprise authentication framework cannot function.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A RADIUS server
Why this is correct
When implementing a new wireless network using WPA2, a RADIUS (Remote Authentication Dial-In User Service) server is essential for WPA2-Enterprise mode. This mode leverages 802.1X for port-based network access control, providing robust, centralized authentication for individual users or devices. The RADIUS server verifies user credentials against a directory service, offering superior security and scalability compared to pre-shared keys by assigning unique encryption keys per session.
- ✗
A pre-shared key
Why it's wrong here
A pre-shared key (PSK) is utilized in WPA2-Personal (also known as WPA2-PSK) mode, where a single, identical passphrase is configured on both the wireless access point and all client devices. While simple to implement for small home or office networks, it lacks individual user authentication and accountability. This method is unsuitable for enterprise environments requiring per-user credentials and dynamic key management, which WPA2-Enterprise provides.
When this WOULD be correct
A pre-shared key would be correct for a question about WPA2-Personal or WPA3-Personal, where a shared passphrase is used for authentication without a RADIUS server.
- ✗
A certificate authority
Why it's wrong here
A Certificate Authority (CA) is a crucial component of a Public Key Infrastructure (PKI), responsible for issuing and managing digital certificates that verify identities. While a CA might be indirectly involved if the RADIUS server uses EAP-TLS for authentication, requiring server and client certificates, it is not a direct, required component for the fundamental operation of the WPA2 wireless network itself. The RADIUS server handles the core authentication logic, even if it relies on certificates issued by a CA.
When this WOULD be correct
A certificate authority would be the correct answer for a question about configuring EAP-TLS authentication within WPA2-Enterprise, where client and server certificates are required and must be issued by a trusted CA.
- ✗
A VPN concentrator
Why it's wrong here
A VPN concentrator is designed to manage and terminate multiple secure remote access VPN tunnels, encrypting traffic between remote clients and the internal network. Its primary function is to provide secure connectivity for users outside the local network perimeter, not to authenticate devices attempting to connect to a local wireless access point. Therefore, it is irrelevant for the initial WPA2 authentication process within the local area network.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓A RADIUS serverCorrect answer▾
Why this is correct
When implementing a new wireless network using WPA2, a RADIUS (Remote Authentication Dial-In User Service) server is essential for WPA2-Enterprise mode. This mode leverages 802.1X for port-based network access control, providing robust, centralized authentication for individual users or devices. The RADIUS server verifies user credentials against a directory service, offering superior security and scalability compared to pre-shared keys by assigning unique encryption keys per session.
✗A pre-shared keyWrong answer — click to see why▾
Why this is wrong here
WPA2-Enterprise uses 802.1X authentication, which requires a RADIUS server for centralized authentication, not a pre-shared key. A pre-shared key is used in WPA2-Personal, not Enterprise.
★ When this WOULD be the correct answer
A pre-shared key would be correct for a question about WPA2-Personal or WPA3-Personal, where a shared passphrase is used for authentication without a RADIUS server.
Why candidates choose this
Candidates may confuse WPA2-Enterprise with WPA2-Personal, assuming a shared key is always required, or they may not understand the role of 802.1X and RADIUS in enterprise authentication.
✗A certificate authorityWrong answer — click to see why▾
Why this is wrong here
WPA2-Enterprise uses 802.1X authentication, which requires a RADIUS server, not a certificate authority. While certificates may be used in the authentication process, the CA is not a mandatory component for WPA2-Enterprise; the RADIUS server handles authentication.
★ When this WOULD be the correct answer
A certificate authority would be the correct answer for a question about configuring EAP-TLS authentication within WPA2-Enterprise, where client and server certificates are required and must be issued by a trusted CA.
Why candidates choose this
Candidates may confuse the role of certificates in some EAP methods (like EAP-TLS) with the overall requirement for WPA2-Enterprise, assuming a CA is always needed, but WPA2-Enterprise can also use other EAP methods that do not require certificates.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.