An audit finds city policy mandates certificate-based EAP, but nobody reviewed which line-of-business apps break with mutual TLS client auth. What requirements step was skipped?
Select an answer to reveal the explanation.
Short Explanation
Mandating EAP-TLS without checking apps is like requiring passport gates without asking if the buses still fit. Inventory clients and apps first, then lock the EAP method.
Full Explanation
An audit finding that city policy mandates certificate-based EAP while nobody reviewed which line-of-business apps break with mutual TLS client authentication means the application and client compatibility review was skipped during WLAN security requirements. EAP-TLS is often the strongest practical enterprise method, but mandating it without testing specialty clients, LOB thick clients, or embedded stacks produces failed logons and shadow SSIDs. Choosing a fun SSID name for the certificate SSID does not validate compatibility. Disabling certificates to avoid any application testing abandons the control instead of scoping it. Assuming all apps support EAP-TLS because browsers exist ignores non-browser clients and devices that cannot store or renew client certificates cleanly. Requirements work should validate readiness, plan onboarding of certificates, and document justified alternate methods only where needed. Exam caveat: preferring EAP-TLS is consistent with strong WLAN security, yet CWSP still expects compatibility analysis or explicit exception planning before a blanket mandate. Operational check: lab-test representative LOB and specialty clients with EAP-TLS against the municipal PKI, document failures and certificate lifecycle gaps, select alternate EAP only with compensating segmentation where justified, and update the requirements record before enforcing the citywide mandate.