A PKI-mature campus already issues managed device certificates and wants the strongest common enterprise WLAN EAP choice among TLS, TTLS, and PEAP. Which selection best fits?
Select an answer to reveal the explanation.
Short Explanation
If the campus already runs a grown-up PKI, EAP-TLS puts those device certs to work for mutual auth. Throwing that away for open Wi-Fi, password-only PEAP forever, or WEP wastes the investment.
Full Explanation
A PKI-mature campus that already issues managed device certificates and wants the strongest common enterprise WLAN EAP choice among TLS, TTLS, and PEAP should prefer EAP-TLS to use existing client certificates for mutual certificate authentication. Open authentication so certificates are never needed abandons Enterprise strength. Preferring PEAP-MSCHAPv2 exclusively and disabling certificate enrollment wastes the PKI investment and remains password-based. Static WEP keys distributed via email are deprecated and unsafe. Exam caveat: when PKI is already mature, EAP-TLS is typically the strongest of the common trio; password-tunneled methods are fallback when certs are unavailable. Operational check: enable EAP-TLS on a pilot staff SSID using existing device certs, validate mutual auth and revocation behavior, then expand. Update the campus WLAN auth standard to list TLS as preferred and TTLS/PEAP as exceptions only. In municipal WLAN operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the infrastructure versions and client fleets used by the civic environment.