A network administrator is designing a wireless security architecture for an enterprise office. The organizational policy mandates centralized user authentication using 802.1X/RADIUS, individual credential accounting, and strict enterprise-grade encryption key management. A junior technician proposes implementing WPA3-Personal with Simultaneous Authentication of Equals (SAE) using a complex 30-character passphrase, arguing it avoids RADIUS server deployment while providing equal security. Which of the following best evaluates the junior technician's proposal?
- The proposal is invalid because WPA3-Personal uses a single shared password, failing to provide centralized 802.1X RADIUS authentication and individual user accounting.Cevap
- BThe proposal is valid because WPA3-Personal automatically negotiates 802.1X EAP user authentication behind the scenes when a complex passphrase is used.
- CThe proposal is invalid because WPA3-Personal defaults to insecure TKIP encryption rather than AES-CCMP or GCMP cipher suites.
- DThe proposal is valid because SAE dynamically generates unique per-user Active Directory login tokens without requiring a central authentication server.
Cevap
The proposal is invalid because WPA3-Personal uses a single shared password, failing to provide centralized 802.1X RADIUS authentication and individual user accounting.
WPA3-Personal uses Simultaneous Authentication of Equals (SAE) to establish secure connections using a pre-shared passphrase. Although SAE protects against offline brute-force attacks, it relies on a shared secret across endpoints and does not support individual user credentials, 802.1X/EAP frameworks, or RADIUS server integration. Enterprise environments requiring central identity management and accounting must deploy WPA3-Enterprise.
Adım Adım Çözüm
Anahtar Kavram
WPA3-Personal vs. WPA3-Enterprise Authentication Modes