When the city’s RADIUS servers are unreachable, engineers propose configuring Enterprise SSID APs to fail open and allow all associations. What is the correct security design stance?
Select an answer to reveal the explanation.
Short Explanation
Fail-open on staff Wi-Fi is like unlocking every office when the badge server blinks. Prefer fail-closed—or a carefully limited degraded mode—not ‘let everyone in until RADIUS wakes up.’
Full Explanation
When city RADIUS servers are unreachable, configuring Enterprise SSID APs to fail open and allow all associations admits unauthenticated clients as fully trusted and must be rejected. Prefer fail-closed or carefully controlled degraded modes that do not treat unauthenticated users as staff-trusted. Claiming availability always outranks authentication for staff Wi-Fi invites compromise during AAA outages. Caching a captive-portal click as perpetual 802.1X success is not Enterprise design. Automatically switching to Open System on mild RADIUS latency collapses authentication under load or attack. Exam caveat: fail-open versus fail-closed is a classic AAA design judgment—CWSP expects fail-open on Enterprise staff SSIDs to be recognized as dangerous. Operational check: test RADIUS outage behavior in a lab SSID, confirm associations are denied or limited per approved degraded policy, implement AAA redundancy, and document the posture in the municipal authentication failure playbook. Alert on RADIUS health so operators restore AAA before users pressure unsafe bypasses. In municipal WLAN operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the infrastructure versions and client fleets used by the civic environment.