A hotel wants the staff WLAN to use one shared passphrase and WPA3, with protected management frames, and it does not want a RADIUS server. Which WLAN security matches that?
Select an answer to reveal the explanation.
Short Explanation
A shared staff passphrase with WPA3 is SAE, the personal method, not a corporate login and not an open door. Your hotel said no RADIUS server. If the design has no passphrase either, you built Enhanced Open instead.
Full Explanation
WPA3-Personal authenticates with SAE and a passphrase, and it uses protected management frames. That matches a single staff passphrase, WPA3, and no RADIUS server. The WLAN security on the controller is WPA3-Personal, or SAE, not an enterprise AKM. WPA3-Enterprise is 802.1X. It needs a RADIUS server and a user or device identity, which the hotel ruled out, even though it also uses protected management frames. Enhanced Open encrypts the link without a passphrase. Staff would not type the shared secret the requirement calls for, so a visitor who never received the passphrase could still associate. Open authentication does not consume a passphrase at all. Putting the passphrase in the SSID name would publish it and would leave the frames unencrypted. Exam caveat: every staff device must be updated to the new passphrase together, and a WPA3-Personal WLAN will not accept a WPA2-only device unless you deliberately run a transition mode you can live with. Operational check: confirm the WLAN shows WPA3-Personal, associate a staff phone with the passphrase, and confirm a phone without the passphrase is rejected.