Policy forbids a single shared passphrase for roughly 500 municipal employees on the primary staff SSID. Which authentication design complies?
Select an answer to reveal the explanation.
Short Explanation
Five hundred people and one sticky-note password is a leak waiting to happen. Enterprise 802.1X gives each person their own auth—not a campus-wide PSK, a hidden open SSID, or dusty WEP.
Full Explanation
Policy that forbids a single shared passphrase for roughly 500 municipal employees on the primary staff SSID requires WPA2/WPA3-Enterprise with 802.1X so each user authenticates individually instead of sharing a Personal PSK. One global WPA2-Personal PSK rotated yearly on a poster still violates the shared-secret ban. Open authentication with a hidden SSID is not individual authentication. WEP-128 with a static key derived from the department name is deprecated and still shared. Exam caveat: scale plus anti-shared-PSK policy is a strong Enterprise signal on CWSP design items—Personal mode cannot satisfy per-user accountability for hundreds of employees. Operational check: migrate staff to Enterprise 802.1X, disable the global PSK SSID, verify accounting shows individual users, and revoke any leftover PSK profiles from imaging templates. Communicate the change through municipal IT onboarding so new hires never receive a shared staff Wi-Fi password. In municipal WLAN operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the infrastructure versions and client fleets used by the civic environment.