N10-009 Question 173
Single answerAuthentication: Pre-shared key (PSK) vs. EnterpriseA company with 250 employees is replacing its office Wi-Fi. Management wants each employee to sign in with their own corporate credentials, and the security team wants the ability to immediately revoke network access for a single terminated user without changing the wireless password for everyone else. The company already uses Active Directory and a RADIUS server. Which wireless authentication method best meets these requirements?
- A
WPA2-Personal with a strong pre-shared key distributed to all employees
- B
WPA2-Enterprise using 802.1X authentication against the existing RADIUS server
- C
WPA3-Personal using SAE, because it eliminates the need for individual user accounts
- D
Open authentication with a captive portal tied to Active Directory
Show answer and explanation
Correct answer: B
Explanation
The best answer is WPA2-Enterprise using 802.1X with RADIUS. The key distinction between PSK (Personal) and Enterprise wireless authentication is that PSK relies on a single shared secret for all users, while Enterprise uses individual authentication, usually through a backend AAA system such as RADIUS. In real-world business environments, Enterprise authentication is preferred when an organization needs centralized control, user-based access, auditing/accounting, and fast revocation of access for specific users. This aligns with IEEE 802.1X authentication practices and common vendor guidance from enterprise wireless providers. By contrast, WPA2-Personal or WPA3-Personal are better suited to home or small environments where shared credentials are acceptable. Captive portals can supplement access control, especially for guest networks, but they are not a replacement for proper enterprise Wi-Fi authentication on internal corporate WLANs.
- A. Incorrect.
Incorrect. WPA2-Personal uses a shared pre-shared key (PSK) for all users on the SSID. Even if the passphrase is strong, it does not provide per-user authentication or easy individual revocation. If one employee leaves or the key is exposed, the organization typically needs to change the PSK on the WLAN and update all client devices. This is a common small-office solution, but it does not meet the stated enterprise management requirement.
- B. Correct.
Correct. WPA2-Enterprise uses 802.1X for port-based network access control and typically authenticates users through a RADIUS server, often integrated with Active Directory. This provides individual authentication, centralized policy enforcement, accounting, and the ability to disable one user's access without changing credentials for everyone else. This is the standard approach for business environments that need scalable, identity-based Wi-Fi access control.
- C. Incorrect.
Incorrect. WPA3-Personal with SAE improves security over traditional PSK methods by resisting offline dictionary attacks more effectively, but it is still a personal/shared-secret model rather than a per-user enterprise authentication model. It does not inherently solve the requirement for individual user logins tied to corporate credentials and selective revocation of one user without affecting others.
- D. Incorrect.
Incorrect. Open authentication with a captive portal may be used for guest access or web-based acceptance workflows, but it does not provide the same layer-2 enterprise wireless authentication and key management as WPA2-Enterprise with 802.1X. Even if integrated with Active Directory at the web portal, it is not the best fit for secure corporate employee Wi-Fi access and does not match the stated requirement as effectively as enterprise wireless authentication.