A small municipal field office SOHO-class AP offers WPA3 Transition for Personal mode versus SAE-only. How should the mode be chosen?
Select an answer to reveal the explanation.
Short Explanation
Transition Mode is the compatibility on-ramp; SAE-only is the tighter Personal setting. Pick from threat model and what devices you still must allow—not ‘keep WEP forever’ or paste passwords on a wiki.
Full Explanation
A small municipal field office SOHO-class AP offering WPA3 Transition for Personal mode versus SAE-only should choose based on the site threat model and whether WPA2-Personal clients must still be allowed. Always forcing Transition Mode so WEP clients remain welcome forever misunderstands Transition and reintroduces legacy risk narratives. Always disabling all encryption when any legacy phone is present is unacceptable. Publishing both the old PSK and the SAE password on a public intranet wiki expands credential exposure. Exam caveat: Transition Mode is a compatibility compromise with residual WPA2-PSK risk; SAE-only is stronger when the client fleet permits—selection is contextual, not absolute. Operational check: list client capabilities at the field office, pick SAE-only if all devices support it, otherwise use Transition with a long passphrase and a short sunset for WPA2-only devices. Record the choice and review date in the municipal branch Wi-Fi register. In municipal WLAN operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the infrastructure versions and client fleets used by the civic environment.