mediumMultiple ChoiceObjective-mapped
EAP-TLS Certificate Trust: Troubleshooting Connection Failures
A company uses WPA2-Enterprise with EAP-TLS for wireless access. An employee reports that a new laptop cannot connect to the wireless network, while older laptops work fine. The employee has installed the correct client certificate. What is the most likely cause?
Quick Answer
The answer is the RADIUS server’s certificate not being trusted by the new laptop. This is correct because EAP-TLS requires mutual authentication: the client must validate the RADIUS server’s certificate against a trusted root CA, just as the server validates the client’s certificate. If the new laptop lacks the necessary root CA certificate—or has an expired one—the EAP-TLS handshake fails, while older laptops with the root CA installed connect successfully. On the CISSP exam, this scenario tests your understanding of Public Key Infrastructure (PKI) trust chains within 802.1X authentication, often appearing as a trap where candidates focus only on the client certificate. Remember the key insight: in EAP-TLS, trust flows both ways. A useful memory tip is “Server first, client next”—the client must trust the server’s certificate before the server will trust the client’s.
⚠ Common exam trap
Watch out — candidates often confuse EAP-TLS with EAP-PEAP or EAP-TTLS, which use MSCHAPv2 for inner authentication, and incorrectly assume the issue is MSCHAPv2 support, when in fact EAP-TLS relies solely on certificate trust.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The RADIUS server's certificate is not trusted by the new laptop.
In WPA2-Enterprise with EAP-TLS, mutual authentication requires the client to validate the RADIUS server's certificate. If the new laptop does not trust the RADIUS server's certificate (e.g., its CA root certificate is missing or expired), the EAP-TLS handshake will fail, preventing connection. Older laptops likely have the necessary root CA installed, while the new laptop does not.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The wireless network uses WPA2-PSK instead of WPA2-Enterprise.
Why it's wrong here
The network is WPA2-Enterprise, not PSK.
- ✓
The RADIUS server's certificate is not trusted by the new laptop.
Why this is correct
EAP-TLS mutual authentication requires the client to trust the server's certificate.
- ✗
The client certificate is not correctly associated with the user account.
Why it's wrong here
The certificate is installed and valid.
- ✗
The laptop does not support MSCHAPv2.
Why it's wrong here
EAP-TLS uses certificates, not MSCHAPv2.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Components
Key term
RADIUS
RADIUS is a network protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISSP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is configuring 802.1X authentication for wired network access. The authentication server supports EAP-TLS. What must be deployed to clients to support this authentication method?
medium- ✓ A.Client certificate
- B.Server certificate
- C.RADIUS server
- D.Shared secret
Why A: EAP-TLS requires mutual authentication using digital certificates on both the client and the server. The client must present a certificate to prove its identity to the authentication server, which is validated against a trusted root CA. Without a client certificate, EAP-TLS cannot establish the TLS tunnel, as it relies on certificate-based client authentication per RFC 5216.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.