A network manager is reviewing a proposed upgrade plan for a corporate wireless network. The organization requires per-user authentication tied to Active Directory so that individual access can be revoked immediately upon employee termination. A technician suggests deploying WPA3-Personal with a complex 32-character passphrase to avoid configuring an 802.1X RADIUS infrastructure. Which of the following best explains why this recommendation fails to meet the organization's security requirements?
- Pre-shared key deployment uses a single shared secret, preventing unique user identification and requiring passphrase rotation across all client devices when offboarding a single employee.Answer
- BWPA3-Personal relies on legacy TKIP encryption rather than AES, making pre-shared passphrase sessions vulnerable to offline dictionary attacks.
- CWPA3-Personal only encrypts management frames, leaving user data payloads unencrypted unless TACACS+ server credentials are supplied.
- DWPA3-Personal disables Protected Management Frames (PMF), allowing unauthorized access points to perform ARP poisoning against connected clients.
Answer
Pre-shared key deployment uses a single shared secret, preventing unique user identification and requiring passphrase rotation across all client devices when offboarding a single employee.
WPA3-Personal uses Simultaneous Authentication of Equals (SAE) with a shared password. While SAE provides forward secrecy and protection against offline dictionary attacks, it still relies on a single shared secret across devices. Consequently, it cannot authenticate individual user accounts against Active Directory or allow an administrator to revoke access for a departing employee without changing the passphrase on every device across the enterprise. Achieving per-user authentication requires WPA3-Enterprise with 802.1X/RADIUS.
Step-by-Step Solution
Key Concept
WPA3-Personal vs. WPA3-Enterprise Authentication Requirements