A municipal visitor WLAN still has legacy open clients that cannot perform OWE. Leadership wants encryption for capable devices without stranding the rest overnight. Which OWE deployment choice fits?
Select an answer to reveal the explanation.
Short Explanation
Transition mode is the temporary two-lane road: new cars get OWE encryption, older ones still roll until you finish the migration. OWE-only is the final state once legacy open clients are gone. Do not “fix” it with a desk-posted WEP key.
Full Explanation
Municipal visitor WLANs often mix OWE-capable smartphones with legacy open clients that cannot perform opportunistic encryption. OWE transition mode lets capable clients obtain individualized encryption while legacy open clients can still associate during migration, avoiding an overnight outage of visitor connectivity at information desks and lobbies. Designers choose transition versus OWE-only based on device inventory and the cutover timeline leadership will actually fund and staff. Jumping to OWE-only immediately may be the correct end state, but it blocks legacy open clients regardless of stated transition needs and can create a political failure that rolls encryption back entirely. Disabling all SSIDs until every visitor device is factory-reset toward WEP is operationally absurd and cryptographically backwards. Replacing OWE with a single shared WEP key posted at the information desk reintroduces a public broken cipher under the guise of simplicity. Exam caveat: transition mode intentionally preserves some open association behavior—track encrypted-versus-open client metrics so the exception does not become permanent municipal policy by neglect. Operational check: enable OWE transition on a visitor pilot SSID, verify an OWE client shows encrypted unicast while a legacy open client still associates, then schedule migration milestones until beacon and association data justify moving to OWE-only.