During a county hospital WLAN security design review, an engineer asks what cryptographic algorithm underlies both CCMP and GCMP. Which answer correctly separates the algorithm from the protocol wrapper?

County hospital design reviews often blur the cryptographic algorithm with the 802.11 protocol that applies it to frames. AES is the block cipher; CCMP and GCMP are protocol constructions that wrap AES—CCM and GCM modes respectively—around WLAN data frames, including integrity protection appropriate to each suite. Correct architecture language therefore separates “AES” as the algorithm from “CCMP/GCMP” as the RSN protocol names used in clinical policy documents, RFQs, and configuration baselines for hospital SSIDs. SAE is Simultaneous Authentication of Equals—an authentication and key-management method for password-based WPA3—not a block cipher that encrypts every data frame under WPA3. Captive-portal HTTPS certificates protect the portal or selected application hops; they do not replace the need for a link-layer cipher on the RF for general clinical device traffic. SNMPv2 community strings are weak management credentials and never provision AES keys for AP user-plane frames in a healthcare WLAN. Exam caveat: saying “AES encryption” casually is common in meetings, but exam items expect you to know that AES alone is incomplete without naming the 802.11 protocol construction and suite constraints that actually get advertised. Operational check: in the hospital WLAN standard, require wording that lists permitted pairwise protocols (CCMP and/or GCMP) and the underlying AES requirement separately, then spot-check a controller template so the advertised RSN IE matches that written separation.