Question

Difficulty: Very hardWireless Security Standards and Encryption Protocols

A network security administrator is performing a compliance audit on an enterprise wireless infrastructure. Match each wireless security standard configuration on the left to its mandatory encryption algorithm and cryptographic authentication mechanism on the right.

  • WPA3-Enterprise (192-bit Security Mode)GCMP-256 cipher suite with EAP-TLS authentication and BIP-GMAC-256
  • WPA3-PersonalCCMP-128 (AES) encryption with Simultaneous Authentication of Equals (SAE)
  • WPA2-EnterpriseCCMP (AES-128) encryption with 802.1X/RADIUS authentication
  • WPA-Personal (Legacy)TKIP stream cipher with Per-Packet Keying and Pre-Shared Key (PSK)

Answer

WPA3-Enterprise (192-bit Security Mode) matches GCMP-256 with EAP-TLS and BIP-GMAC-256; WPA3-Personal matches CCMP-128 with SAE; WPA2-Enterprise matches CCMP with 802.1X/RADIUS; WPA-Personal (Legacy) matches TKIP with PSK.
Each wireless security standard defines strict baseline requirements for encryption ciphers and key exchange mechanisms. WPA3 192-bit mode enforces GCMP-256 and EAP-TLS for maximum security compliance. WPA3-Personal mandates SAE to prevent offline brute-force attacks. WPA2-Enterprise mandates CCMP (AES-128) paired with 802.1X central RADIUS authentication. Legacy WPA utilizes TKIP to wrap RC4 for backwards compatibility.

Step-by-Step Solution

1
Identify the high-security enterprise mode specifications
WPA3-Enterprise 192-bit mode requires CNSA Suite compliance, enforcing GCMP-256 encryption, EAP-TLS, and BIP-GMAC-256 management frame protection.
Top-tier enterprise environments mandate 192-bit cryptographic strength for both data privacy and management frame integrity.
2
Differentiate WPA3-Personal from WPA2-Personal authentication key exchange
WPA3-Personal introduces SAE (Simultaneous Authentication of Equals) to replace standard PSK while retaining CCMP-128 (AES).
SAE provides forward secrecy and resistance against passive dictionary attacks.
3
Determine standard WPA2-Enterprise components
WPA2-Enterprise combines AES-based CCMP encryption with RADIUS-backed 802.1X authentication.
Enterprise modes decouple user authentication from the encryption cipher by leveraging an external authentication server.
4
Map legacy WPA-Personal mechanisms
Legacy WPA uses TKIP to encapsulate RC4 with dynamic per-packet keys over PSK authentication.
TKIP was designed as an interim mitigation for legacy hardware supporting WEP.

Key Concept

Mapping IEEE 802.11 security standards (WPA, WPA2, WPA3) to their mandatory encryption algorithms (TKIP, CCMP, GCMP) and authentication methods (PSK, 802.1X/RADIUS, SAE).
Rate this question