A city conference-room transition SSID still negotiates TKIP for older laptops. How should the security engineer treat TKIP?
Select an answer to reveal the explanation.
Short Explanation
TKIP was the duct-tape patch after WEP fell apart—not the forever fix. If city conference rooms still negotiate it, retire that path and move everyone to AES-based CCMP or GCMP.
Full Explanation
TKIP was an interim integrity and encryption design for the WPA era and is deprecated relative to AES-CCMP and newer GCMP modes used in modern robust security networks. A city conference-room transition SSID that still negotiates TKIP for older laptops reintroduces known weaknesses and should be reconfigured so only modern AES-based ciphers are offered. Mandating TKIP-only mode as a long-term civic standard freezes the municipality on deprecated crypto. Preferring TKIP over CCMP because it uses RC4 for battery life is historically and cryptographically wrong for current WLAN security design. Keeping TKIP because the SSID name contains the word Secure is branding theater, not cipher selection. Exam caveat: transition/mixed profiles that still allow TKIP for compatibility are a common trap—exam items often expect you to disable TKIP even when a few legacy laptops complain, or to isolate those clients rather than weaken citywide crypto. Operational check: export the conference SSID cipher suites from the controller, disable TKIP/WPA-era options, validate that representative laptops associate with CCMP or GCMP only, and quarantine or replace holdouts. Note the change in the municipal WLAN encryption standard so other transition SSIDs do not silently re-enable TKIP.