Security wants to mandate WPA3-Enterprise 192-bit mode on the courthouse SSID. What must be verified first?
Select an answer to reveal the explanation.
Short Explanation
192-bit mode isn’t a checkbox you flip while clients still speak yesterday’s suites. Inventory capability first—hiding the SSID or turning RADIUS off doesn’t magically grant CNSA-class crypto.
Full Explanation
Before mandating WPA3-Enterprise 192-bit mode on the courthouse SSID, verify that clients and infrastructure support the aligned cipher and suite requirements. Assuming every client still supports only TKIP so 192-bit mode can translate to RC4 is nonsensical and unsafe. Hiding the SSID does not enable 192-bit suites. Disabling RADIUS so 192-bit mode can use local PSKs contradicts Enterprise 192-bit design. Exam caveat: high-assurance modes fail closed when endpoints lack suite support—capability verification precedes mandates. Operational check: inventory laptop Wi-Fi capabilities, lab-test 192-bit negotiation on courthouse APs, remediate or except holdouts, then enforce. Keep the compatibility matrix with the court IT security package for the go-live gate review. In municipal WLAN operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the infrastructure versions and client fleets used by the civic environment. Treat this decision as part of the CWSP security lifecycle: identify the requirement, select the control, verify in a pilot, monitor for drift, and audit evidence on a recurring municipal cadence rather than assuming a one-time configuration change remains correct indefinitely.