Facilities still has a mix of WPA3-capable phones and older barcode scanners. Leadership asks whether to force strict WPA3 or allow a transition mode. What is the sound selection principle?
Select an answer to reveal the explanation.
Short Explanation
Transition Mode is a bridge with a toll: older scanners get on, pure WPA3 toughness takes a hit. Use it knowingly while migrating—not as a permanent lifestyle. Portal banners and stripping RSN are not substitutes for AKM design.
Full Explanation
Facilities fleets mixing WPA3-capable phones and older barcode scanners force an explicit selection principle: choose WPA3 Transition Mode only when legacy clients cannot join otherwise, understanding it weakens the pure-WPA3 security posture until migration finishes. Transition Mode is a dated bridge with known tradeoffs, not a forever default for civic convenience. Leadership deserves that clarity when asking whether to force strict WPA3.
Enabling Transition Mode forever so PSK clients never need certificates or firmware updates normalizes the weaker posture. Using RSN Override banners on captive portals instead of any 802.11 AKM configuration does not set ciphers. Disabling RSN information elements so mixed clients fall back to Open System authentication only is a severe regression.
Exam caveat: document which device classes force Transition Mode and the replacement date—exceptions without end dates become permanent risk. Operational check: inventory scanner capabilities, enable Transition Mode only on the constrained SSID, test both client classes, and track migration percentage toward pure WPA3. In municipal WLAN programs, capture the decision in the wireless standard and re-check it at change review so the next project inherits the same control bar instead of rediscovering the failure during an outage.