Examkin

Question

Difficulty: HardWireless Security and Authentication

An IT administrator is configuring a high-security corporate wireless network for a firm's mobile workforce. Corporate policy mandates mutual authentication using client and server digital certificates integrated with a central RADIUS server. Additionally, legacy non-domain mobile devices that only support shared passphrases must be accommodated on a segregated network segment using current security standards. Which TWO of the following configuration choices must the administrator implement to satisfy all policy requirements?

  1. Configure WPA3-Enterprise utilizing EAP-TLS authentication for the corporate wireless networkAnswer
  2. Deploy a dedicated SSID for legacy devices utilizing WPA3-Personal with Simultaneous Authentication of Equals (SAE) assigned to an isolated VLANAnswer
  3. C
    Configure WPA2-Enterprise utilizing PEAP-MSCHAPv2 authentication to enforce client certificate requirements
  4. D
    Deploy WPA2-Personal with Temporal Key Integrity Protocol (TKIP) encryption to maintain compatibility with legacy passphrase devices

Answer

The administrator must implement WPA3-Enterprise utilizing EAP-TLS authentication for corporate clients, and deploy a dedicated SSID using WPA3-Personal (SAE) on an isolated VLAN for non-domain passphrase devices.
WPA3-Enterprise configured with EAP-TLS satisfies the mutual certificate authentication requirement because EAP-TLS explicitly requires both server-side and client-side digital certificates. WPA3-Personal with SAE on an isolated VLAN provides modern passphrase security and logical traffic separation for non-domain devices without resorting to deprecated encryption algorithms.

Step-by-Step Solution

1
Evaluate enterprise authentication protocols against the requirement for mutual certificate authentication.
Select EAP-TLS under WPA3-Enterprise.
EAP-TLS is the standard EAP type that mandates digital certificates on both the RADIUS server and the client machine for mutual authentication.
2
Evaluate options for passphrase-based clients needing network isolation.
Select WPA3-Personal (SAE) on a separate VLAN.
SAE provides strong key exchange for passphrase-authenticated clients while VLAN isolation ensures non-domain devices remain segregated from corporate assets without relying on weak legacy ciphers like TKIP.

Key Concept

Wireless Security Protocols and Enterprise Authentication Mechanisms
Estimated Time:2m 0s
Rate this question

Topics

Wireless Security and Authentication

More questions from this topic