Small city satellite offices still use WPA2-PSK for a handful of staff laptops. What should replace that AKM for stronger personal-mode security?
Select an answer to reveal the explanation.
Short Explanation
Old WPA2-PSK is the shared house key that never changes. SAE in WPA3-Personal hardens that personal-mode handshake without forcing full 802.1X. Posting the key in DNS or going open is just inviting strangers in.
Full Explanation
Small city satellite offices still using WPA2-PSK for a handful of staff laptops should move to WPA3-Personal with SAE when full enterprise 802.1X is not yet practical. SAE improves personal-mode authentication relative to legacy WPA2-PSK and reduces classic offline dictionary exposure for forward-looking municipal small sites that still need encrypted staff access. It is a concrete security step up without pretending a four-laptop annex instantly grows a complete PKI and NAC stack overnight.
Downgrading to WEP-40 to simplify roaming between buildings is a severe security regression. Publishing the PSK in DNS TXT records for easier onboarding advertises the secret to anyone who can query DNS. Disabling encryption and relying on physical door locks alone ignores RF reach beyond the door and adjacent office suites.
Exam caveat: WPA3-Personal still uses a shared logical secret model—prefer Enterprise/EAP when identity accountability is required; SAE is the better personal-mode choice, not the ultimate enterprise design. Operational check: enable WPA3-Personal (SAE) on a pilot SSID, verify laptop join and PMF behavior, retire WPA2-PSK, and record passphrase vaulting and rotation ownership.