An auditor asks why the city’s staff SSID uses CCMP instead of TKIP. What is the best explanation?
Select an answer to reveal the explanation.
Short Explanation
TKIP was the emergency spare tire after WEP blew out—fine to limp home, not what you mount for the next decade. CCMP (AES) is the proper wheel; that is why city staff SSIDs left TKIP behind.
Full Explanation
Auditors asking why the city’s staff SSID uses CCMP instead of TKIP should hear a clear cryptography narrative: TKIP was only an interim integrity/encryption design after WEP and is deprecated, while AES-based CCMP became the standard robust pairwise cipher, with GCMP used in later high-throughput contexts. That migration is why municipal staff SSIDs standardize on CCMP (or newer AES suites) rather than TKIP. Claiming TKIP is newer than CCMP and remains preferred reverses the timeline. Saying CCMP exists only for guest SSIDs while staff must use RC4 invents a false role split and reintroduces deprecated algorithms. Treating TKIP and CCMP as identical algorithms with different marketing names erases the AES versus TKIP/RC4 distinction the exam expects candidates to know. Exam caveat: CCMP vs TKIP is a cipher-suite decision inside RSN/WPA2-era networks; do not confuse it with AKM choice (PSK vs 802.1X) or with SSID visibility. Operational check: show the auditor the staff SSID RSN cipher list, demonstrate TKIP is disabled, and produce a WLAN scan sample proving CCMP (or GCMP) negotiation. Keep that evidence in the municipal compliance binder for the next wireless review. In municipal WLAN operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the infrastructure versions and client fleets used by the civic environment.