City utilities IoT sensors cannot perform 802.1X, and operations proposed one global PSK on an open SSID. Which authentication approach is most appropriate for those constrained devices?
Select an answer to reveal the explanation.
Short Explanation
If the gadget can’t do 802.1X, don’t shrug and leave the door open. WPA3-Personal SAE—or carefully managed per-device PSKs—beats ‘anyone may associate.’ Demanding certs the chip can’t hold, or rolling WEP, isn’t the win.
Full Explanation
City utilities IoT sensors that cannot perform 802.1X should use WPA3-Personal with SAE, or a managed per-device/per-user PSK pattern—not an open network and not a single careless global PSK on open SSID assumptions. Leaving the SSID open and relying on MAC randomization provides no meaningful authentication. Forcing EAP-TLS when sensors lack certificate stores or 802.1X stacks fails operationally. Enabling WEP for legacy meters reintroduces deprecated crypto. Exam caveat: constrained IoT often lands on strong Personal SAE or MPSK-style designs with segmentation; open and WEP are never the professional consolation prizes. Operational check: place sensors on an isolated utility SSID with SAE or unique PSKs, firewall them to OT brokers only, monitor for rogue peers, and inventory passphrase handling. Review residual risk with utilities operations and the municipal CISO before production rollout. In municipal WLAN operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the infrastructure versions and client fleets used by the civic environment.