SY0-701 Question 266
Single answerA company is replacing its shared Wi-Fi password with a more secure solution for employee laptops and phones. The security team wants each user to authenticate with unique credentials, centralize authorization and accounting, and use modern wireless encryption that reduces the risk of offline password-guessing attacks. Some legacy scanners will remain on a separate network. Which wireless configuration should the administrator implement for the employee SSID?
- A
WPA3-Enterprise with 802.1X authentication backed by a RADIUS server
- B
WPA3-Personal using SAE with a strong shared passphrase for all employees
- C
WEP with Open System authentication and MAC filtering
- D
WPA2-Enterprise with TKIP and a local access point user database
Show answer and explanation
Correct answer: A
Explanation
The best choice is WPA3-Enterprise with 802.1X and RADIUS. The scenario calls for four key outcomes: unique user authentication, centralized AAA, strong cryptographic protection, and an enterprise-ready wireless design. WPA3-Enterprise addresses these needs by pairing enterprise authentication methods with modern Wi-Fi security. In enterprise WLANs, the access point or wireless LAN controller typically acts as the authenticator, the user device is the supplicant, and the RADIUS server performs backend AAA functions. This architecture supports individual credentials, policy enforcement, and accounting records.
WPA3-Personal with SAE is a real and important improvement over WPA2-PSK because SAE helps mitigate offline password-guessing attacks, but it is still a shared-secret model and therefore does not meet the requirement for centralized AAA with unique user identities. WEP and TKIP-based designs should be avoided because they are deprecated and do not meet current security best practices.
This aligns with common guidance from the Wi-Fi Alliance and NIST best practices favoring WPA3 where supported, using 802.1X/EAP with a RADIUS backend for enterprise wireless access, and avoiding legacy protocols such as WEP and TKIP.
- A. Correct.
Correct. WPA3-Enterprise is designed for organizational environments that need per-user authentication and centralized AAA services. In practice, this is commonly implemented with IEEE 802.1X on the wireless network and a backend RADIUS server that provides authentication, authorization, and accounting. WPA3-Enterprise uses stronger, modern cryptographic protections than older Wi-Fi modes, and it avoids the weakness of a single shared password used by all employees. This best matches the requirements for unique credentials, centralized control, and modern security.
- B. Incorrect.
Incorrect. WPA3-Personal uses SAE, which is stronger than WPA2-PSK and helps resist offline dictionary attacks against captured handshakes. However, it still relies on a shared passphrase rather than unique user identities. Because the company wants centralized AAA and per-user authentication, WPA3-Personal does not satisfy the administrative and auditing requirements.
- C. Incorrect.
Incorrect. WEP is obsolete and cryptographically broken. Open System authentication provides essentially no real authentication, and MAC filtering is not a strong security control because MAC addresses can be observed and spoofed. This option fails both the modern encryption requirement and the centralized AAA requirement.
- D. Incorrect.
Incorrect. WPA2-Enterprise does support 802.1X-style enterprise authentication, but TKIP is deprecated and significantly weaker than modern AES-based protections. In addition, using a local access point user database does not provide the centralized AAA model requested. The mention of enterprise authentication makes this distractor plausible, but the cryptographic and AAA details make it unsuitable.