Examkin

Question

Difficulty: Very hardWireless Security and Authentication

A network administrator is designing an enterprise wireless infrastructure with varying security requirements across departments. Match each wireless authentication protocol or framework to its specific technical deployment requirement or operational security characteristic.

  • EAP-TLSMandates digital certificates installed on both the RADIUS server and every connecting client device for mutual authentication.
  • PEAPCreates an encrypted TLS tunnel using a server-side certificate only, allowing client authentication via password protocols like MS-CHAPv2.
  • WPA3-Enterprise (192-bit Mode)Requires GCMP-256 encryption and HMAC-SHA384 integrity protection for high-security enterprise environments.
  • WPA2-PersonalUtilizes a Pre-Shared Key (PSK) with CCMP (AES) cipher suites, remaining vulnerable to offline dictionary attacks if weak passphrases are used.

Answer

EAP-TLS pairs with server and client certificate requirement; PEAP pairs with server-side certificate creating a TLS tunnel for password authentication; WPA3-Enterprise (192-bit Mode) pairs with GCMP-256 encryption and HMAC-SHA384; WPA2-Personal pairs with PSK and CCMP vulnerable to offline dictionary attacks.
Each wireless framework is correctly matched based on standard 802.11 and 802.1X specifications: EAP-TLS mandates mutual PKI certificate verification; PEAP builds a server-authenticated TLS tunnel to protect user password challenges; WPA3-Enterprise (192-bit mode) elevates enterprise security with GCMP-256; and WPA2-Personal relies on static PSKs paired with CCMP encryption.

Step-by-Step Solution

1
Analyze certificate requirements for 802.1X EAP types
Identify that EAP-TLS strictly requires mutual authentication via digital certificates on both server and client endpoints, whereas PEAP requires a certificate only on the server.
Differentiating EAP-TLS from PEAP depends on evaluating certificate management complexity versus password authentication capabilities.
2
Evaluate high-security WPA3 suite specifications
Confirm that 192-bit WPA3-Enterprise specifies Suite B cryptographic standards including GCMP-256 cipher suites and SHA-384 message integrity.
Standard WPA2/WPA3 uses 128-bit CCMP/GCMP, whereas the optional 192-bit mode upgrades symmetric encryption to 256-bit GCMP.
3
Examine legacy SOHO security traits and attack vectors
Determine that WPA2-Personal relies on a static pre-shared key (PSK) with CCMP, which exposes the four-way handshake to offline dictionary attacks.
WPA3 replaced PSK with SAE to prevent offline dictionary attacks, making PSK vulnerability a key trait of WPA2-Personal.

Key Concept

Wireless Authentication Protocols and Enterprise Encryption Standards
Rate this question

Topics

Wireless Security and Authentication

More questions from this topic