Wireless & Network Security

CompTIA A+ 220-1201 & 220-1202

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

About the CompTIA A+ Certification Exam Domains & Study Strategy

2 Core 1 Domain 1: Mobile Devices (13%)

Laptop Hardware & Components Laptop Features & Display Types Mobile Device Connectivity & Accessories Mobile Operating System Features Mobile Device Synchronization & Data Transfer

3 Core 1 Domain 2: Networking (23%)

TCP/IP Fundamentals & the OSI Model Common Ports & Protocols Wireless Networking Standards Network Hardware & Devices Network Configuration & Internet Connections Network Types & Topologies

4 Core 1 Domain 3: Hardware (25%)

Cables & Connectors RAM Types & Storage Devices Motherboards, CPUs & Power Supplies Printers & Multifunction Devices Peripheral Devices & Expansion Cards Network Cable Tools & Testing

5 Core 1 Domain 4: Virtualization & Cloud Computing (11%)

Virtualization Concepts Cloud Computing Models & Services Client-Side Virtualization in Practice

6 Core 1 Domain 5: Hardware & Network Troubleshooting (28%)

CompTIA Troubleshooting Methodology Hardware Troubleshooting Network Troubleshooting Printer Troubleshooting Display & Mobile Device Troubleshooting

7 Core 2 Domain 1: Operating Systems (28%)

Windows Editions & Features Windows Administrative Tools & Utilities Windows Command Line & PowerShell macOS & Linux Basics Windows Networking & File Sharing Windows Installation & Upgrade Methods

8 Core 2 Domain 2: Security (28%)

Physical & Logical Security Measures Malware Types & Threat Mitigation Wireless & Network Security Encryption & Data Protection

9 Core 2 Domain 3: Software Troubleshooting (23%)

Windows OS Troubleshooting Mobile OS & Application Troubleshooting Browser & Application Troubleshooting

10 Core 2 Domain 4: Operational Procedures (21%)

Documentation & Change Management Backup & Recovery Methods Safety & Environmental Procedures Scripting & Remote Access Technologies Privacy, Licensing & Organizational Policies

Wireless & Network Security

Key Takeaways Explain This Topic AI

WPA3 is the current wireless standard: WPA3-Personal uses SAE (replacing the WPA2 4-way handshake) for forward secrecy, and Enhanced Open (OWE) encrypts otherwise-open networks; never deploy WEP.

Enterprise wireless uses 802.1X with a RADIUS server so each user has unique credentials — disabling a departed employee's account is enough, with no need to rotate a shared PSK.

Harden a SOHO router by changing the default admin password and SSID, disabling WPS, updating firmware, and choosing WPA2/WPA3; MAC filtering and SSID hiding are weak supplements, not real security.

Firewalls should follow 'deny all, permit by exception'; Windows Defender Firewall (wf.msc) keeps separate inbound/outbound rules for Domain, Private, and Public profiles.

Degaussing destroys data on magnetic HDDs and tape but does NOT work on SSDs; for SSDs use ATA Secure Erase, crypto-erase, or physical destruction.

Last updated: October 2026

Wireless Security: Pick the Right Protocol

Wireless security protocols are part of 220-1202 objective 2.3, and SOHO wireless settings are part of objective 2.10. Memorize this preference order from strongest to forbidden:

WPA3-Enterprise — 802.1X + RADIUS, optional 192-bit suite for high security.

WPA3-Personal — uses SAE (Simultaneous Authentication of Equals), giving forward secrecy and resistance to offline dictionary attacks.

WPA2-Enterprise — 802.1X + RADIUS with AES-CCMP.

WPA2-Personal — PSK + AES; acceptable but no forward secrecy.

WPA (TKIP) — avoid; deprecated.

WEP — never use ; crackable in minutes.

WPA3 also adds Enhanced Open (Opportunistic Wireless Encryption / OWE) , which encrypts traffic on an open guest network without a password, and Wi-Fi Easy Connect for headless IoT onboarding.

SOHO Router Hardening Checklist

Action Why it matters
Change default admin password Default creds are published online
Change default SSID Hides model/manufacturer hints
Enable WPA3 (WPA2 minimum) with a 12+ char passphrase Encrypts the air
Disable WPS The 8-digit PIN is brute-forceable
Update firmware Patches router CVEs
Disable remote/WAN admin Stops Internet-side management
Enable guest network isolation Segments visitor devices
MAC filtering / hide SSID Weak add-ons only — MACs are spoofable, SSIDs are still beaconed

Trap: the exam treats MAC filtering and SSID suppression as not real security because both are trivially bypassed. They never substitute for WPA2/WPA3 encryption.

802.1X / RADIUS

Role Device
Supplicant The client requesting access
Authenticator The AP or switch relaying the request
Authentication server RADIUS, validating against Active Directory

Flow: supplicant → authenticator → RADIUS checks the directory → accept/reject. Because each user holds individual credentials or a certificate , offboarding is just disabling one account — no shared PSK to rotate across the whole office.

Firewalls

Type Where it runs Example
Host-based On one computer Windows Defender Firewall, iptables
Network-based Appliance at the edge pfSense, Fortinet, Cisco ASA

A firewall rule matches source IP, destination IP, port, protocol (TCP/UDP/ICMP), and action (allow/deny) . The hardened design is deny all, permit by exception — block everything, then open only required ports such as 443. In Windows Defender Firewall (wf.msc) rules are scoped to Domain, Private, and Public profiles, with independent inbound and outbound rule sets.

Common Network Attacks

Attack Mechanism Mitigation
Man-in-the-middle Intercepts traffic between two parties HTTPS/TLS, VPN, HSTS
DNS poisoning Corrupts resolver cache to redirect DNSSEC, trusted resolvers
ARP poisoning Spoofs MAC-to-IP mappings on the LAN Dynamic ARP inspection
DDoS Floods a service from many hosts Upstream scrubbing, rate limiting
Deauth attack Forces Wi-Fi clients to drop WPA3, 802.11w management frame protection
Rogue DHCP Hands out bad gateway/DNS DHCP snooping on switches
On-path evil twin Fake AP captures credentials WPA3-Enterprise, certificate validation
Zero-day Exploits an unpatched flaw Defense in depth, behavioral detection
Secure Data Destruction

When retiring drives, the disposal method must match the media:

Method Works on Note
Standard format (insecure) Data is recoverable
ATA Secure Erase SSD and HDD Firmware-level wipe
Degaussing HDD, tape Magnetic only — destroys the drive
Crypto-erase SSD Encrypt then destroy the key
Shred / drill / incinerate All media Most thorough, physical

Critical SSD rule: degaussing has no effect on SSDs because flash stores data as electric charge, not magnetism. For SSDs, use Secure Erase, crypto-erase, or physical destruction.

Outsourced Destruction and Chain of Custody

When a third party destroys media, the exam expects a certificate of destruction (or recycling) documenting each serial number, the method used, and the date. This proves due diligence for compliance audits (HIPAA, PCI-DSS, GDPR). Maintain chain of custody from the moment a drive leaves service until it is verifiably destroyed, so no drive can quietly walk off with data intact.

VPNs and Securing Remote Access

A Virtual Private Network (VPN) builds an encrypted tunnel between a remote device and the corporate network, protecting data in transit across untrusted links such as public airport or coffee-shop Wi-Fi. Without a VPN, traffic on an open network is exposed to evil-twin and on-path attacks; with one, an eavesdropper sees only ciphertext.

Remote-access concept What it does
Client-to-site VPN One user's device tunnels into the corporate LAN
Site-to-site VPN Two offices link their networks over the Internet
Split tunneling Only corporate traffic uses the tunnel; the rest goes direct
Full tunneling All traffic routes through the corporate gateway for inspection

For remote management, prefer encrypted protocols : SSH (port 22) instead of Telnet (23), RDP (3389) only over a VPN, and HTTPS (443) instead of HTTP (80) for web admin. These map directly to the "data in transit" protection state.

Public Wi-Fi scenario: a sales rep needs to reach internal files from a hotel. The correct answer is connect through the company VPN first , which encrypts the session end to end. Simply seeing a padlock on one website does not protect everything else the device sends, and an open hotel network leaves all unencrypted traffic readable.

Tie the chapter together with defense in depth : physical controls, strong authentication and least privilege, hardened wireless and firewalls, encryption of data at rest and in transit, and ongoing user education each handle a different layer — no single control is sufficient on its own, which is the recurring theme across all 28% of the Security domain.