hardMultiple ChoiceObjective-mapped
220-1201 Practice Question: A technician is deploying a fleet of tablets that…
A technician is deploying a fleet of tablets that must connect to a corporate network using 802.1X authentication with certificates. After configuring the Wi-Fi profile, some tablets fail to connect. The technician verifies the SSID and security settings are correct. What is the most likely missing configuration?
⚠ Common exam trap
The 220-1201 exam often tests the distinction between authentication failures due to missing root CA versus certificate expiration or date/time issues, trapping candidates who assume a simple time sync problem when the real issue is a missing trust anchor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The tablets are missing the root CA certificate in their trusted store.
802.1X authentication using EAP-TLS requires the client to validate the server's certificate against a trusted root CA. If the root CA certificate is missing from the tablet's trusted store, the client cannot verify the RADIUS server's identity, causing the EAP-TLS handshake to fail. This is the most likely issue since the SSID and security settings are already confirmed correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The tablets have the wrong date and time set.
Why it's wrong here
While an incorrect date and time setting on the tablets could potentially lead to certificate validation failures by making a valid certificate appear expired or not yet valid, it is not the most fundamental issue preventing secure authentication in this scenario. Certificate validation checks the validity period against the device's clock. However, if the root CA certificate is entirely absent from the trusted store, the device cannot establish a trust relationship with the authentication server, making date/time a secondary concern.
- ✓
The tablets are missing the root CA certificate in their trusted store.
Why this is correct
For 802.1X authentication using EAP-TLS or PEAP with server-side certificates, the client device (tablet) must validate the identity of the authentication server (e.g., RADIUS server). This validation requires the client to possess the root Certificate Authority (CA) certificate that signed the server's certificate, or an intermediate CA certificate whose chain leads back to a trusted root. Without this crucial root CA in its trusted store, the tablet cannot verify the authenticity of the server's certificate, leading to a failed secure handshake and preventing connection to the network.
- ✗
The tablets are using WPA2-Personal instead of WPA2-Enterprise.
Why it's wrong here
WPA2-Personal (PSK) relies on a shared passphrase for authentication, whereas WPA2-Enterprise utilizes 802.1X with a RADIUS server for individual user or device authentication, often involving certificates. If the technician has already verified the security settings, it implies they have correctly configured the tablets for WPA2-Enterprise. Attempting to use WPA2-Personal would result in an immediate authentication failure due to mismatched security protocols, which would likely be a more obvious and immediate error than a certificate trust issue.
- ✗
The tablets have a static IP configured that conflicts with the DHCP scope.
Why it's wrong here
An IP configuration conflict, such as a static IP address clashing with the DHCP scope, would typically manifest *after* a device has successfully authenticated to the network and attempted to obtain or use an IP address. Network authentication (e.g., 802.1X) occurs at Layer 2 (Data Link Layer) to grant access to the network. Only once authenticated does the device proceed to Layer 3 (Network Layer) to acquire an IP address, making this issue irrelevant to the initial authentication failure.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 972 original 220-1201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1201 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1201 exam.