220-1101 Question 358
Single answerSecurityA technician is deploying a new wireless network for a small medical office. The office wants to protect patient data, support modern laptops and phones, and avoid using an outdated shared password that staff can easily disclose. The existing wireless router and client devices all support current security standards. Which of the following should the technician configure to BEST meet these requirements?
- A
WPA2-Personal with TKIP
- B
WPA3-Personal with SAE
- C
WPA2-Enterprise with AES and a RADIUS server
- D
Open network with a captive portal
Show answer and explanation
Correct answer: C
Explanation
The best answer is WPA2-Enterprise with AES and a RADIUS server because the scenario emphasizes three key requirements: protection of sensitive data, support for modern devices, and avoiding a shared password. Enterprise wireless authentication addresses the main weakness of personal mode by assigning credentials per user instead of using one PSK for everyone. This aligns with standard security best practices for business and healthcare environments, where individual accountability and easy credential revocation are important. AES is the recommended encryption method for WPA2, while TKIP is deprecated and should be avoided. Although WPA3-Personal is newer, it still uses a shared passphrase and therefore does not fully meet the requirement to avoid that model. Guidance from Wi-Fi Alliance security recommendations and common enterprise deployment best practices supports using enterprise authentication with centralized credential management for organizational wireless networks.
- A. Incorrect.
This is incorrect. WPA2-Personal uses a pre-shared key, which is still a shared password that staff can disclose. TKIP is also outdated and less secure than AES. In a business handling sensitive data, this would not be the best choice even if some older devices still support it.
- B. Incorrect.
This is incorrect. WPA3-Personal with SAE is stronger than WPA2-Personal and improves protection against password guessing, but it still relies on a shared passphrase for all users. The scenario specifically says the office wants to avoid an outdated shared password approach, so a personal mode solution is not the best fit.
- C. Correct.
This is correct. WPA2-Enterprise with AES and a RADIUS server provides per-user authentication rather than a single shared wireless password. That makes it more appropriate for a medical office protecting patient data, because access can be managed individually and revoked for one user without changing the entire wireless credential. AES is the appropriate secure encryption choice for WPA2 in business environments.
- D. Incorrect.
This is incorrect. A captive portal may be useful for guest access, but it does not provide the level of wireless encryption and authentication needed for a protected internal office network handling sensitive information. An open network exposes traffic before portal-based authentication and is not appropriate for securing patient data.