Examkin

Question

Difficulty: Very hardWireless Security Standards and Encryption Protocols

A network engineer at a high-density regional hospital is upgrading the facility's wireless infrastructure to improve security and auditability. The security policy mandates that every medical staff member must authenticate to the corporate SSID using their unique Active Directory credentials, allowing central logging of user sessions via 802.1X RADIUS. During the deployment planning, a technician proposes configuring WPA3-Personal with Simultaneous Authentication of Equals (SAE) and distributing unique static passphrases to staff groups to avoid modifying existing RADIUS server certificate policies. Which of the following best explains why the technician's proposed solution fails to meet the corporate security mandate, and what configuration must be enforced instead?

  1. WPA3-Personal using SAE relies on pre-shared passphrase authentication rather than centralized 802.1X RADIUS credential validation; WPA3-Enterprise must be deployed to integrate with Active Directory user identities.Answer
  2. B
    WPA3-Personal using SAE natively integrates with 802.1X EAP frameworks, but it fails because RADIUS servers require TACACS+ encapsulation to process SAE handshake tokens.
  3. C
    WPA3-Personal with SAE satisfies 802.1X RADIUS requirements, but it must be configured with TKIP encryption to support individual user credential tracking.
  4. D
    WPA3-Personal provides individual user authentication via SAE, but it is unusable in corporate settings because Protected Management Frames (PMF) are disabled in WPA3 modes.

Answer

WPA3-Personal using SAE relies on pre-shared passphrase authentication rather than centralized 802.1X RADIUS credential validation; WPA3-Enterprise must be deployed to integrate with Active Directory user identities.
WPA3-Personal uses Simultaneous Authentication of Equals (SAE) to secure password-based connections against offline dictionary attacks, but it remains a pre-shared key technology that cannot pass individual user credentials to an 802.1X RADIUS server. To fulfill the mandate of authenticating staff members individually against Active Directory with centralized RADIUS accounting, the network must enforce WPA3-Enterprise.

Step-by-Step Solution

1
Analyze the security mandate requirements
Identified two primary requirements: individual user credential authentication against Active Directory via 802.1X RADIUS and centralized session auditability.
Security mandates require mapping network access to unique user identities rather than shared group credentials.
2
Evaluate the technician's proposed WPA3-Personal (SAE) solution
Determined that SAE (Simultaneous Authentication of Equals) replaces the WPA2-Pre-Shared Key (PSK) mechanism to protect against offline dictionary attacks, but still operates on a passphrase basis.
SAE lacks support for Extensible Authentication Protocol (EAP) mechanisms needed to query backend 802.1X RADIUS servers for individual domain credentials.
3
Determine the required security standard
Selected WPA3-Enterprise as the mandatory standard.
WPA3-Enterprise explicitly enforces 802.1X EAP authentication, enabling individual Active Directory user authentication and RADIUS session accounting.

Key Concept

Wireless Security Standards and Encryption Protocols
Rate this question

Topics

Wireless Security Standards and Encryption Protocols

More questions from this topic