For a standard WPA2 enterprise redesign at city hall, which pairwise cipher should replace deprecated TKIP?
Select an answer to reveal the explanation.
Short Explanation
TKIP was the transitional bandage; CCMP with AES is the real WPA2 pairwise cipher. Don’t ‘upgrade’ into WEP, bare RC4, or cleartext after login.
Full Explanation
For a standard WPA2 enterprise redesign at city hall, the pairwise cipher that replaces deprecated TKIP is CCMP using AES as the standard WPA2 pairwise cipher suite. WEP-40 with dynamic keying is not a modern default and remains deprecated. RC4 stream cipher without a robust message integrity design belongs to the WEP/TKIP era, not WPA2-RSN redesigns. Cleartext data frames once 802.1X completes would abandon confidentiality after authentication. Exam caveat: 802.1X authenticates; CCMP/GCMP encrypt—completing EAP does not make cleartext acceptable, and TKIP must not remain as a compatibility crutch on redesigned WPA2 enterprise SSIDs. Operational check: set city hall enterprise SSIDs to CCMP-only (or newer GCMP where appropriate), disable TKIP, validate client associations, and archive pre/post RSN cipher scans. Update the municipal encryption standard so future SSIDs inherit AES-CCMP as the WPA2 baseline without TKIP exceptions. In municipal WLAN operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the infrastructure versions and client fleets used by the civic environment.