Examkin

Question

Difficulty: HardWireless Security Standards and Encryption Protocols

A network engineer is configuring a single Service Set Identifier (SSID) on an enterprise wireless access point to support both modern corporate laptops and legacy handheld scanners during a phased migration to WPA3. To achieve backward compatibility without establishing separate wireless networks, the engineer selects WPA3-Personal Transition Mode. Which TWO of the following technical requirements and configurations must be implemented on the access point for this deployment? (Select TWO.)

  1. Simultaneous Authentication of Equals (SAE) must operate alongside WPA2 Pre-Shared Key (PSK) authentication.Answer
  2. Protected Management Frames (PMF) must be configured as optional/capable rather than mandatory.Answer
  3. C
    802.1X RADIUS authentication must be enabled to issue individualized session keys for legacy devices.
  4. D
    Temporal Key Integrity Protocol (TKIP) must be enabled as the fallback cipher suite for WPA2 connections.

Answer

Simultaneous Authentication of Equals (SAE) operating alongside WPA2 Pre-Shared Key (PSK) authentication, and Protected Management Frames (PMF) configured as optional/capable rather than mandatory.
WPA3-Personal Transition Mode is designed for dual-stack legacy compatibility. It enables Simultaneous Authentication of Equals (SAE) for modern clients while allowing legacy clients to authenticate using Pre-Shared Key (PSK) with AES-CCMP encryption. Furthermore, because Protected Management Frames (PMF/802.1w) are mandatory in pure WPA3 but unsupported by legacy WPA2 devices, the access point must set PMF to optional/capable to permit legacy association.

Step-by-Step Solution

1
Analyze the authentication requirements for WPA3-Personal Transition Mode on a shared SSID.
Transition mode requires dual-stack authentication where WPA3 devices negotiate SAE and WPA2 devices fall back to PSK.
This guarantees seamless connectivity for legacy devices while providing enhanced security (Diffie-Hellman key exchange via SAE) for newer devices.
2
Determine the Protected Management Frames (PMF / IEEE 802.1w) configuration setting.
PMF must be configured to 'capable' (optional).
WPA3 mandates PMF as required, but legacy WPA2 devices frequently lack 802.1w support. Setting PMF to mandatory would prevent legacy WPA2 clients from associating.
3
Evaluate distractor configurations regarding enterprise authentication and encryption ciphers.
Reject 802.1X/RADIUS and TKIP options.
WPA3-Personal modes use SAE/PSK pre-shared mechanisms rather than centralized 802.1X RADIUS authentication. Additionally, TKIP is deprecated and prohibited under WPA3 standards, which require AES-CCMP.

Key Concept

WPA3-Personal Transition Mode Requirements and PMF Negotiation
Estimated Time:2m 0s
Rate this question

Topics

Wireless Security Standards and Encryption Protocols

More questions from this topic