712-50 Question 305
Single answerWireless Security (5 questions)A global enterprise is redesigning wireless access for its headquarters and several regional offices. The CISO has mandated that the new WLAN must provide strong protection for corporate users, support centralized credential management, and reduce the risk of password sharing or compromise associated with a pre-shared key. Some older handheld devices used in warehouses do not support the newest wireless standard, but they do support 802.1X. The security architecture team is deciding which approach should be mandated as the enterprise baseline for employee Wi-Fi access. Which option is the MOST appropriate?
- A
Deploy WPA3-Personal with a complex pre-shared passphrase rotated quarterly across all sites
- B
Deploy WPA2-Enterprise or WPA3-Enterprise using 802.1X authentication integrated with a central RADIUS service
- C
Deploy an open wireless network and rely on a VPN client for all internal access control
- D
Deploy MAC address filtering with hidden SSIDs to limit unauthorized wireless connections
Show answer and explanation
Correct answer: B
Explanation
For enterprise wireless security, best practice is to use 802.1X-based enterprise authentication rather than shared pre-shared keys for employee access. IEEE 802.1X with a RADIUS backend supports centralized authentication, authorization, and accounting, enabling stronger governance and user-level accountability. This directly addresses common CISO concerns such as shared password sprawl, difficulty revoking access, and lack of audit traceability. WPA3-Enterprise is preferred where supported, but WPA2-Enterprise remains a valid enterprise-grade option for backward compatibility with older devices that still support 802.1X. Guidance from organizations such as NIST, including wireless security recommendations in NIST SP 800-153 and enterprise authentication practices reflected in 802.1X deployments, supports using enterprise modes over personal/shared-key approaches for corporate environments. Open networks with VPN-only protection and legacy techniques such as MAC filtering or hidden SSIDs do not provide equivalent network access security and should not be treated as the primary control for enterprise WLAN access.
- A. Incorrect.
This is incorrect because WPA3-Personal still relies on a shared password model, even though it improves security over older pre-shared key approaches. A complex passphrase and periodic rotation do not solve the core governance and operational problem of credential sharing among employees. For an enterprise that wants centralized identity-based control, rapid revocation of individual access, and better auditability, a personal mode based on a shared secret is not the best baseline.
- B. Correct.
This is correct because WPA2-Enterprise or WPA3-Enterprise with 802.1X provides per-user or per-device authentication tied to centralized identity services through RADIUS. This aligns with enterprise governance goals such as individual accountability, easier credential revocation when staff leave, stronger access control, and reduced exposure from shared passwords. It also accommodates the scenario constraint that older warehouse devices support 802.1X even if they do not support the newest Wi-Fi standard. In practice, an enterprise may use WPA3-Enterprise where supported and WPA2-Enterprise for legacy compatibility during a controlled transition.
- C. Incorrect.
This is incorrect because an open wireless network exposes management and onboarding risks and does not provide native WLAN access control or encryption in the same way an enterprise-protected SSID does. Although VPN can add encryption for application traffic, it is not a substitute for secure wireless authentication and authorization at the network access layer. This choice would also increase operational complexity and risk, especially before the VPN tunnel is established.
- D. Incorrect.
This is incorrect because MAC filtering and hidden SSIDs are weak controls that can be bypassed with basic wireless reconnaissance techniques. MAC addresses can be spoofed, and hidden SSIDs are easily discovered from client association traffic. These measures may be used as minor administrative hurdles, but they are not appropriate as the enterprise baseline for securing employee wireless access.