Interactive: Wireless Security Protocols and Authentication

A small office wants the strongest built-in Wi-Fi protection without running a separate authentication server. Which configuration should the technician deploy?

• WPA2-Enterprise with RADIUS

• Open network with MAC filtering

• WPA3-Personal with SAE

• WPA2-Personal with TKIP

Answer explanation

WPA3-Personal uses SAE, giving strong protection without a RADIUS server. WPA2-Enterprise is stronger but requires that server, which the office does not have.

Tags

Blooms Level: Apply

A legacy access point supports WPA2 with TKIP or AES. Which cipher best protects the wireless network?

• TKIP, because it rotates keys per packet

• TKIP, for broader device compatibility

• AES, because it uses a stronger cipher

• Either option provides equal security

Answer explanation

AES uses a stronger encryption algorithm and is the recommended choice. TKIP was a transitional fix for older hardware and is now considered weak and deprecated.

Tags

Blooms Level: Analyze

A company wants each employee to log into Wi-Fi using their own domain credentials, with central logging of access attempts. Which solution fits best?

• Kerberos tickets issued by the access point

• WPA3-Personal with a shared passphrase

• WPA2-Enterprise with RADIUS

• WPA2-Personal with a rotating PSK

Answer explanation

WPA2-Enterprise with RADIUS authenticates each user individually and logs attempts centrally. Personal modes use a shared passphrase and cannot track individual users.

Tags

Blooms Level: Apply

Which statements correctly describe WPA3 compared to WPA2? (Select all that apply.)

• WPA3 improves protection against offline password guessing

• WPA3 replaces the PSK handshake with SAE

• WPA3 removes the need for any passphrase

• WPA3 still allows TKIP as a cipher

Answer explanation

WPA3 uses SAE instead of the WPA2 4-way handshake, which resists offline dictionary attacks. TKIP is not permitted in WPA3, and a passphrase is still required in Personal mode.

Tags

Blooms Level: Analyze

Which characteristics apply to RADIUS but not to TACACS+? (Select all that apply.)

• Commonly used for 802.1X Wi-Fi authentication

• Primarily uses UDP

• Encrypts only the password in the packet

• Separates authentication, authorization, and accounting fully

Answer explanation

RADIUS uses UDP, encrypts only the password field, and is the standard protocol for 802.1X Wi-Fi. TACACS+ uses TCP, encrypts the entire payload, and fully separates AAA functions.

Tags

Blooms Level: Analyze

Match each authentication protocol to its defining characteristic.

• TCP-based AAA, encrypts the full payload

• RADIUS

• UDP-based AAA, encrypts only the password

• Kerberos

• Ticket-granting authentication over a trusted KDC

• Multifactor authentication

• Combines two or more different credential factors

• TACACS+

Answer explanation

Each protocol has a distinct mechanism. Students often swap RADIUS and TACACS+; remember RADIUS is UDP with partial encryption, TACACS+ is TCP with full payload encryption.

Tags

Blooms Level: Understand

Sort each configuration by the wireless security tier it provides.

Groups:

(a) Deprecated or weak

,

(b) Acceptable current standard

,

(c) Strongest recommended

• WPA2-Enterprise with AES and RADIUS

• WPA2 with TKIP only

• WPA3-Enterprise with AES-256

• WPA3-Personal with SAE

• WEP with shared key

• WPA2-Personal with AES

Answer explanation

WEP and TKIP are broken or outdated. WPA2 with AES is still acceptable today. WPA3 variants are the current strongest choice and should be preferred when all devices support it.

Tags

Blooms Level: Analyze