Examkin

Question

Difficulty: HardWireless Security and Authentication

A network technician is configuring wireless access for specialized barcode scanners in a distribution warehouse. The primary corporate wireless network relies on WPA3-Enterprise with 802.1X/RADIUS authentication using EAP-TLS client certificates. The new handheld scanners cannot store digital certificates or perform 802.1X authentication, but they fully support WPA3-Personal utilizing Simultaneous Authentication of Equals (SAE). Company policy requires network isolation for non-802.1X devices while maintaining the strongest possible wireless security controls without lowering the authentication requirements of the primary corporate network. Which of the following is the BEST solution for the technician to implement?

  1. Provision a new dedicated SSID configured with WPA3-Personal assigned to a segregated VLAN for the barcode scanners.Answer
  2. B
    Modify the primary corporate SSID to WPA3-Enterprise with TKIP protocol fallback to allow non-certificate devices to connect.
  3. C
    Reconfigure the primary corporate SSID to WPA2-Personal so that all corporate laptops and warehouse scanners share a single passphrase.
  4. D
    Set up an open wireless network for the scanners and restrict access exclusively using MAC address filtering on the access points.

Answer

Provision a new dedicated SSID configured with WPA3-Personal assigned to a segregated VLAN for the barcode scanners.
Deploying a dedicated SSID configured for WPA3-Personal (SAE) on a separate VLAN isolates non-802.1X handheld scanners from corporate assets while enforcing strong WPA3 pre-shared key encryption. This meets device compatibility requirements without weakening the 802.1X/EAP-TLS security on the primary corporate SSID.

Step-by-Step Solution

1
Analyze device capabilities and enterprise constraints.
The handheld scanners lack 802.1X/EAP-TLS authentication capabilities but support WPA3-Personal (SAE).
Devices that cannot process client certificates cannot authenticate against an 802.1X RADIUS server on a WPA3-Enterprise network.
2
Evaluate security policy requirements.
Policy mandates network isolation for non-enterprise authentication devices without degrading corporate WPA3-Enterprise security.
Modifying or downgrading the main corporate SSID compromises existing security controls for corporate users.
3
Select the optimal wireless architecture solution.
Create a secondary SSID utilizing WPA3-Personal (SAE) bound to a dedicated guest/IoT VLAN.
This configuration delivers robust WPA3 encryption for the scanners while using VLAN segmentation to isolate non-802.1X traffic from corporate network resources.

Key Concept

WPA3-Personal vs Enterprise Coexistence and Network Segmentation
Estimated Time:2m 0s
Rate this question

Topics

Wireless Security and Authentication

More questions from this topic