220-1102 Question 253
Single answerNetworkA technician is configuring a small office network that uses a wireless router provided by the ISP. Employees report that they can connect to the Wi-Fi, but company laptops are receiving warnings that the wireless network is not secure enough to access internal resources. The office manager also wants to avoid using an outdated passphrase-based method if a more secure option is available. Which wireless security setting should the technician configure on the router to BEST meet these requirements?
- A
WPA2-Personal (PSK) with AES
- B
WPA3-Personal with SAE
- C
WEP with 128-bit encryption
- D
Open network with MAC filtering only
Show answer and explanation
Correct answer: B
Explanation
The best answer is WPA3-Personal with SAE. In a real-world office environment, technicians should choose the strongest supported wireless security standard that balances protection and compatibility. WPA3 improves on WPA2 by using SAE instead of the older pre-shared key handshake, helping protect against offline dictionary attacks. WPA2-AES remains common and acceptable when WPA3 is unavailable, but it is not the best option when stronger supported security is requested. WEP and open networks with MAC filtering do not meet modern security expectations. This aligns with current Wi-Fi Alliance guidance and standard security best practices for securing small business wireless networks.
- A. Incorrect.
WPA2-Personal with AES is much more secure than WEP and is still widely supported, but it relies on a pre-shared key rather than the more secure authentication improvements available in WPA3-Personal. A technician might choose this because it has been a common best practice for years, but it does not best satisfy the requirement to avoid an older passphrase-based approach when a stronger option is available.
- B. Correct.
WPA3-Personal with SAE is correct because it provides stronger wireless security than WPA2-Personal and replaces the traditional PSK exchange with Simultaneous Authentication of Equals (SAE), which is more resistant to offline password-guessing attacks. This best meets the requirement for improved security and aligns with current wireless security best practices when supported by the router and client devices.
- C. Incorrect.
WEP with 128-bit encryption is incorrect because WEP is obsolete and insecure. Its encryption can be cracked with readily available tools, and modern business systems commonly flag it as unsafe. A candidate might choose this option due to the mention of encryption strength, but the bit length does not make WEP acceptable for modern secure deployments.
- D. Incorrect.
Open network with MAC filtering only is incorrect because MAC filtering is not a substitute for encryption or secure authentication. MAC addresses can be observed and spoofed, and an open network would leave traffic unprotected. This reflects a common misconception that access control alone provides wireless security.