On a city employee 802.1X SSID, a junior tech expects DHCP Discover before EAP succeeds "because the client needs an IP to authenticate." What sequencing awareness should the CWNE enforce?
Select an answer to reveal the explanation.
Short Explanation
Enterprise Wi-Fi doesn't hand out a hall pass before checking your badge. Association and EAP come first; DHCP is the locker key afterward. Don't mix that up with captive-portal guest flows.
Full Explanation
On enterprise 802.1X SSIDs, the normal join order is 802.11 authentication/association, then EAP and key establishment, then DHCP. When a junior tech on a city employee SSID expects DHCP Discover before EAP succeeds "because the client needs an IP to authenticate," the CWNE must enforce that association and EAP/keying normally complete before DHCP; expecting DHCP before EAP confuses captive-portal or open flows with enterprise join order.
Requiring DHCP to finish before Open System Authentication fails by concept: Open System Authentication and association are Layer-2 steps that precede IP assignment on enterprise BSS joins. Claiming EAP-TLS requires a routable IP before EAPoL-Start fails by concept: EAPoL runs over the 802.11 link before the client has a productive IP lease. Treating captive-portal and 802.1X enterprise SSIDs as identical Layer-3-before-EAP ordering fails by concept: captive flows often involve pre-auth web redirection patterns that must not be projected onto 802.1X enterprise sequencing.
Exam caveat: CWNE sequencing questions punish conflating open/guest captive behavior with 802.1X enterprise join order; know which stage must succeed before DHCP troubleshooting begins.
Operational check: Capture a city-employee join from probe through DHCP, verify Association success, then EAP success and 4-way handshake, and only then DHCP Discover—coach the junior tech against filtering solely for DHCP when EAP has not finished.