A city HR pilot wants WPA3-Enterprise 192-bit mode, but many older staff phones lack that suite. What encryption-selection constraint must the architect respect?
Select an answer to reveal the explanation.
Short Explanation
Crypto suites are not wishful thinking—if the phone cannot speak 192-bit, it will not magically join. Either upgrade the fleet or pick an enterprise suite the clients actually support, with a phased plan. TKIP is not a 192-bit consolation prize.
Full Explanation
WPA3-Enterprise 192-bit mode is a cryptographic suite requirement, not a wishful checkbox. A city HR pilot that wants 192-bit security must respect client crypto capability; otherwise the architect selects a supported Enterprise suite for today’s phones or executes a phased handset upgrade plan before mandating 192-bit. Inventory, AAA readiness, and migration planning are part of encryption selection—not optional paperwork after production users fail to join. Enabling 192-bit mode anyway and expecting unsupported phones to fall back automatically to WEP is false and dangerous; there is no such sanctioned consolation path in a modern Enterprise profile. Claiming 192-bit mode works only on wired Ethernet ignores that the requirement is a WLAN Enterprise suite selection affecting staff mobility. Forcing TKIP on the SSID so every phone can join contradicts both 192-bit goals and contemporary cipher policy. Exam caveat: AP support alone is insufficient—RADIUS/EAP methods, certificate profiles, and client supplicant settings must also align with the 192-bit suite before HR declares success. Operational check: build a capability matrix of HR phone models against 192-bit support, pilot the mode on a test SSID with known-good devices, and document which models require upgrade or an interim non-192-bit Enterprise profile before the mandate becomes citywide.