SY0-701 Security Architecture Practice Question
A company wants all corporate laptops to authenticate to Wi-Fi using device certificates instead of shared passwords. It also wants to deny network access to systems that do not meet the baseline requirement for disk encryption and current endpoint protection. Which approach best satisfies both goals?
⚠ Common exam trap
It's easy for candidates to confuse 802.1X with simple certificate authentication and overlook the NAC posture check component, assuming that certificate-based authentication alone meets the baseline requirement, but the question explicitly requires denying access to non-compliant systems, which only NAC can enforce.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy 802.1X with certificate-based authentication and network access control posture checks.
802.1X with certificate-based authentication ensures that only devices with valid certificates can authenticate to the Wi-Fi network, eliminating reliance on shared passwords. Network access control (NAC) posture checks then evaluate each device against baseline requirements (e.g., disk encryption, current endpoint protection) and deny access to non-compliant systems. This combination directly satisfies both goals of certificate-only authentication and conditional access based on security posture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a single WPA2-Personal passphrase and email it to all employees.
Why it's wrong here
WPA2-Personal with a shared passphrase authenticates only the passphrase itself, not the device or user, so anyone possessing the key can join the network. This approach cannot verify that a laptop is corporate-owned or compliant with security policies, and revoking access for a departing employee requires changing the passphrase for everyone, which is operationally impractical.
- ✓
Deploy 802.1X with certificate-based authentication and network access control posture checks.
Why this is correct
802.1X using EAP-TLS or a similar certificate-based protocol provides mutual authentication: the corporate laptop presents a client certificate stored in its machine store, and the RADIUS/AAA server validates it against the CA, ensuring only authorized corporate devices connect. Network Access Control (NAC) posture checks then assess compliance criteria such as OS patch level, antivirus status, and disk encryption, automatically quarantining noncompliant devices until they are remediated.
- ✗
Allow any device to join and rely on antivirus scans after users log in.
Why it's wrong here
Allowing any device to join the network before performing a scan grants unauthenticated, policy-less access to the internal LAN, where a compromised or noncompliant device can immediately communicate with other hosts. Antivirus scans executed after login are reactive, cannot detect zero-day or rootkit infections that evade signature-based detection, and provide no mechanism to enforce baseline security settings or prevent personal devices from accessing corporate resources.
- ✗
Use MAC address filtering and a captive portal for all internal Wi-Fi users.
Why it's wrong here
MAC address filtering is a weak control because 802.11 frames are broadcast in plaintext, allowing an attacker to sniff a valid MAC address and spoof it with simple tools; thus it does not provide strong device authentication. A captive portal only forces a web-based login or policy acceptance, which can be satisfied by any device with a browser and does not verify the device's identity, ownership, or compliance with corporate security requirements.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Network Access Control
Network Access Control is a security solution that enforces policies to control which devices and users can connect to a network, ensuring only authorized and compliant endpoints gain access.
Key term
Security posture
An organization's overall cybersecurity strength, including policies, controls, and readiness to defend against and respond to threats.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.