Finance insists the tax-system SSID use a shared WPA2-Personal passphrase 'because it is simpler than 802.1X.' 802.1X infrastructure already exists. What architecture choice is appropriate?
Select an answer to reveal the explanation.
Short Explanation
High-value SSIDs deserve per-user 802.1X, not a hallway PSK. When RADIUS is already standing there, use it. Guest portals and WEP are the wrong neighborhood for tax traffic.
Full Explanation
When finance insists the tax-system SSID use a shared WPA2-Personal passphrase because it is simpler than 802.1X—and 802.1X infrastructure already exists—architecture should prefer WPA2/WPA3-Enterprise with 802.1X for high-value corporate SSIDs. Shared PSKs lack per-user accountability and are painful to rotate after staff changes in tax and treasury workflows. Existing EAP infrastructure removes the usual feasibility excuse.
Keeping WPA2-Personal and printing the PSK on every badge for convenience maximizes secret sprawl. Moving the tax SSID to Open plus captive portal identical to guest Wi-Fi collapses confidentiality for high-value systems. Using WEP-104 because legacy assessor tablets still list it is obsolete crypto.
Exam caveat: if a tiny set of legacy devices truly cannot do EAP, isolate them on a constrained exception SSID rather than weakening the whole tax SSID. Operational check: migrate a finance pilot group to Enterprise, confirm AAA role mapping, and show leadership that PSK rotation tickets disappear for that cohort. In municipal WLAN programs, capture the decision in the wireless standard and re-check it at change review so the next project inherits the same control bar instead of rediscovering the failure during an outage.