Vendor default profiles on city APs include a 'WPA/WPA2 mixed' mode that still enables TKIP for compatibility. How should that default be treated?
Select an answer to reveal the explanation.
Short Explanation
Mixed WPA/WPA2 with TKIP still allowed is a compromise buffet—the weakest diner picks the meal. For city APs, shut off those defaults and serve only modern ciphers.
Full Explanation
Vendor default WPA/WPA2 mixed profiles frequently re-enable TKIP or other legacy options for backward compatibility, which reintroduces deprecated cryptography into city AP fleets. Security engineers should treat those defaults as deprecated-risk configurations, disable them, and enforce WPA2/WPA3 settings with AES-based ciphers only. Enabling mixed mode everywhere so every vintage client dictates city crypto policy lets the weakest endpoint set the municipal baseline. Assuming mixed mode equals WPA3-Enterprise 192-bit security confuses marketing compatibility toggles with high-assurance suites. Preferring mixed mode because the word mixed implies stronger layered encryption misunderstands that mixed often means weaker options remain negotiable. Exam caveat: mixed/transition settings are not automatically wrong in every Personal migration, but any mix that reintroduces TKIP/WPA-era crypto is the wrong answer when the stem frames deprecated risk; read whether the mix includes TKIP. Operational check: compare shipping defaults to the approved city template, disable WPA/TKIP mixed options on a pilot AP, confirm client connectivity with CCMP/GCMP-only, then push the hardened template. Record exceptions for true legacy devices with isolation and end dates rather than leaving mixed mode as the global default.