2.2 - Wireless security and authentication methods
CompTIA A+ Core 2 objective 2.2 focuses on securing wireless networks and the authentication that protects them. WPA3 is the strongest current Wi-Fi security protocol and should be chosen over WPA2 or the obsolete WEP. You must know the authentication factors - something you know, something you have and something you are - and that combining at least two of them is multifactor authentication (MFA), far stronger than a password alone. Encryption scrambles data so only key holders can read it, and enterprise Wi-Fi authenticates users centrally against a RADIUS server. A key exam trap: hiding the SSID and MAC filtering are weak on their own because both are easily bypassed by sniffing or spoofing. Expect questions that ask for the strongest option or the best combination of controls.
Strongest Wi-Fi = WPA3 (WPA2 over WEP, never WEP). MFA = mix at least two of KNOW / HAVE / ARE. Enterprise Wi-Fi logins = RADIUS. Trap: hiding the SSID + MAC filtering are weak alone (sniff/spoof).
Practice questions
1. Why are hiding the SSID and MAC filtering considered WEAK Wi-Fi security on their own?
- They noticeably slow down the whole network
- They cost extra money to set up and maintain
- They are easily bypassed by sniffing/spoofing (correct answer)
- They completely turn off wireless encryption
Hidden SSIDs are still broadcast in frames, and MAC addresses can be sniffed and spoofed — use strong encryption (WPA3) instead.
2. Which wireless security protocol is the STRONGEST currently available?
- WEP
- WPA
- WPA2
- WPA3 (correct answer)
WPA3 is the newest and strongest Wi-Fi encryption. WEP is broken; WPA/WPA2 are older.
3. Which protocol centrally authenticates network/Wi-Fi users against a server (e.g., WPA2-Enterprise)?
- DHCP service
- RADIUS server (correct answer)
- SMTP relay
- ICMP echo
RADIUS provides centralized AAA (authentication, authorization, accounting), used by WPA2/3-Enterprise and VPNs.
4. Which authentication protocol uses time-sensitive tickets and is core to Active Directory logons?
- FTP login
- Kerberos (correct answer)
- SNMP polling
- Telnet session
Kerberos uses tickets (and a KDC) for secure SSO in AD; correct system time is required for tickets to validate.
5. A secure entrance uses two interlocking doors so only one person passes at a time. What is this control?
- A decoy attacker network honeypot
- An access control vestibule (mantrap) (correct answer)
- A caching forward web proxy server
- A logically segmented network VLAN
An access control vestibule (mantrap) is a physical control that prevents tailgating by allowing one authenticated person through at a time.
6. What does a firewall primarily do?
- It speeds up the system CPU
- It allows or blocks traffic by rules (correct answer)
- It stores nightly system backups
- It charges the connected laptop
A firewall enforces rules that allow or block traffic by port, IP, or application, protecting a host or network boundary. Host firewalls protect one PC.