N10-009 Question 172
Single answerAuthentication: Pre-shared key (PSK) vs. EnterpriseA company is replacing its single wireless password on the corporate SSID after discovering that several former contractors still know the key. The IT manager wants each employee to sign in with individual credentials, wants the ability to disable one user's access without changing the entire wireless configuration, and wants accounting records showing who connected to the network. Which wireless authentication approach best meets these requirements?
- A
Configure WPA2-Personal with a stronger pre-shared key and rotate it quarterly
- B
Configure WPA2-Enterprise using 802.1X with a RADIUS server
- C
Configure an open network and use MAC address filtering for approved devices
- D
Configure WPA3-Personal in transition mode so older devices can still use the shared password
Show answer and explanation
Correct answer: B
Explanation
The best answer is WPA2-Enterprise using 802.1X with a RADIUS server because the scenario specifically calls for individual authentication, selective revocation, and connection tracking. These are core advantages of Enterprise authentication over PSK/Personal modes. In a PSK deployment, everyone shares the same secret, so if one user leaves, the organization often must change the password for the entire SSID and redistribute it. By contrast, Enterprise mode authenticates each user separately against a centralized identity source, commonly through RADIUS, and supports AAA functions: authentication, authorization, and accounting. This aligns with widely accepted wireless best practices and vendor documentation for enterprise WLAN deployments, including guidance from the Wi-Fi Alliance, Cisco, Aruba, and Microsoft on using 802.1X for managed business networks.
- A. Incorrect.
This is incorrect. WPA2-Personal uses a shared pre-shared key (PSK) for all users on the SSID. Even if the password is made stronger and rotated regularly, it does not provide unique user authentication, per-user revocation, or centralized accounting of which individual authenticated. This option reflects a common misconception that stronger password complexity alone solves identity and audit requirements.
- B. Correct.
This is correct. WPA2-Enterprise uses 802.1X authentication, typically backed by a RADIUS server, to authenticate users individually rather than with one shared password. This allows administrators to disable one user's access without changing the wireless settings for everyone else, and RADIUS can provide authentication and accounting logs showing who connected. This is the standard enterprise approach when organizations need centralized access control, user-based authentication, and auditability.
- C. Incorrect.
This is incorrect. An open network provides no wireless-layer authentication or encryption, and MAC filtering is not a secure substitute for real authentication because MAC addresses can be spoofed. It also does not provide user-based identity or reliable accounting tied to actual employee credentials. This option is plausible because some small environments use MAC allowlists, but it does not meet enterprise security or management requirements.
- D. Incorrect.
This is incorrect. WPA3-Personal still relies on a shared password model, even though it improves security over older PSK implementations. Transition mode is designed to support compatibility between WPA2 and WPA3 clients, not to provide per-user credentials, centralized revocation, or identity-based accounting. The key issue in the scenario is the limitation of shared credentials, which Personal mode does not solve.