A municipal operations center needs every staff AP to check user credentials against a central AAA store before granting WLAN access. Which authentication service belongs in that design?
Select an answer to reveal the explanation.
Short Explanation
Think of RADIUS as the city’s badge desk for Wi-Fi. The AP doesn’t keep every employee password in its pocket—it asks a central AAA server. Shared PSKs, MAC lists, and click-to-accept portals aren’t that central credential check.
Full Explanation
A municipal operations center that needs every staff AP to check user credentials against a central AAA store before granting WLAN access requires RADIUS as the AAA protocol and service for enterprise WLAN authentication. Local WPA2-Personal passphrases stored only on each access point cannot provide centralized AAA checks. Open authentication with MAC filtering as the sole gate is weak and spoofable. Captive-portal click-through with no backend identity check does not validate staff credentials against a central store. Exam caveat: RADIUS is the common AAA service paired with 802.1X/EAP on enterprise SSIDs—Personal PSK and open portals are not AAA substitutes even if they feel simpler to configure on APs. Operational check: point staff APs at the city RADIUS VIPs, authenticate a test user, confirm Access-Accept/Reject logging, and verify failure closes network access. Document shared-secret hygiene and AAA redundancy in the municipal auth design so outages do not tempt fail-open shortcuts. In municipal WLAN operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the infrastructure versions and client fleets used by the civic environment.