SSCP Security Operations and Administration Practice Question
A security administrator needs to ensure that only authorized devices can connect to the corporate wireless network. Which of the following should be implemented to meet this requirement?
⚠ Common exam trap
The trap here is assuming that hiding the SSID or using MAC filtering provides strong access control, when both are easily bypassed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
WPA2-Enterprise with 802.1X
WPA2-Enterprise with 802.1X authenticates each device or user individually, typically against a RADIUS server, before granting network access. This ensures that only authorized devices can connect. MAC filtering, PSK, and SSID hiding are either weak or do not provide per-device authorization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
WPA2-Enterprise with 802.1X
Why this is correct
WPA2-Enterprise with 802.1X provides strong, certificate-based or credential-based authentication for each device or user before network access is granted. It ensures that only authorized devices with valid credentials can connect, and it supports dynamic key management. This meets the requirement for strict device authorization.
- ✗
MAC address filtering
Why it's wrong here
MAC address filtering allows or denies devices based on their hardware address. However, MAC addresses can be spoofed easily, so it provides weak security. It is not sufficient to ensure only authorized devices connect, as an attacker can impersonate a permitted MAC address and gain access.
- ✗
SSID broadcasting disabled
Why it's wrong here
Disabling SSID broadcast hides the network name but does not prevent unauthorized devices from connecting if they know or guess the SSID. It is a weak obscurity measure, not an authentication control. It does not verify device authorization, so it fails to meet the requirement.
- ✗
Pre-shared key (PSK) authentication
Why it's wrong here
A pre-shared key is a single password shared among all users. If one device is compromised or the key is leaked, all devices are at risk. It does not distinguish between authorized and unauthorized devices beyond possession of the key, so it does not ensure only authorized devices connect.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.