A civic guest SSID capture shows an RSN IE advertising both WPA2 and WPA3 AKM suites together. What does that RSN IE evidence indicate about the BSS security mode?
Select an answer to reveal the explanation.
Short Explanation
That RSN IE is the AP's security menu. Seeing WPA2 and WPA3 AKMs side by side means transition mode—both old and new keys are on the table—not a hard WPA3-only lock. Read the suites before you call it an override.
Full Explanation
The Robust Security Network Information Element enumerates pairwise and group ciphers and AKM suites the BSS accepts. On a civic guest SSID, an RSN IE that advertises both WPA2 and WPA3 AKM suites together is the capture signature of transition mode, which deliberately allows mixed client populations rather than a strict WPA3-only or WPA2-only override. Analysts should read the suites in the IE instead of inferring policy from the SSID name alone.
Claiming the BSS is locked to WPA3-192-bit Enterprise only because mixed AKM fields are ignored fails by concept: mixed advertised AKMs indicate transition, not a 192-bit-only lock, and clients do not simply ignore listed suites. Asserting RSN IEs never list multiple AKMs so the capture must be discarded fails by concept: multiple AKMs are valid and expected in transition configurations. Treating mixed suites as proof of WEP with TKIP wrapping fails by concept: WPA2/WPA3 AKM coexistence is a modern transition design, not legacy WEP evidence.
Exam caveat: CWNE security captures distinguish transition mode from override by the RSN IE contents; SSID naming conventions and marketing labels are not authoritative when the IE disagrees.
Operational check: Decode the civic guest Beacon RSN IE, list AKM suites and ciphers, document whether both WPA2 and WPA3 AKMs appear, and align controller policy (transition versus WPA3-only) with the city's client inventory before blaming capture tools.