City IT is retiring WPA2-Personal on the parks-crew SSID because offline dictionary attacks against a shared passphrase keep succeeding in audits. Which WPA3-Personal AKM mechanism should replace that password-based design?
Select an answer to reveal the explanation.
Short Explanation
WPA2-Personal’s shared PSK is like one master key hanging on a hook—steal the hash, grind it offline, and you’re in. SAE is a password handshake that doesn’t hand attackers that same offline gift. Same idea of a passphrase, much better ceremony.
Full Explanation
City IT retiring WPA2-Personal on the parks-crew SSID because offline dictionary attacks against a shared passphrase keep succeeding should replace classic PSK AKM with SAE (Simultaneous Authentication of Equals) for WPA3-Personal. SAE is still password-based for crews who need a passphrase model, but it is engineered to resist the offline cracking workflow that made captured WPA2-Personal handshakes so damaging in audits. The municipal outcome is stronger Personal-mode AKM without pretending every parks device is ready for full Enterprise certificates overnight. Keeping the same PSK derivation while shortening the passphrase to eight characters for “faster roaming” worsens dictionary risk and misunderstands both AKM and roaming. Advertising WEP with shared-key authentication because devices are legacy-only is a cryptographic regression, not a WPA3 path. Disabling all AKM and relying on MAC allow-lists printed on crew vans provides spoofable filtering without modern key establishment. Exam caveat: SAE still depends on passphrase quality and operational secrecy—SAE is not a license for posting “Parks2024!” on the break-room whiteboard. Operational check: migrate a parks test SSID to WPA3-Personal SAE, verify beacons advertise SAE rather than legacy PSK-only AKM, and confirm a representative rugged device completes association while a lab attempt to reuse old WPA2-PSK offline techniques no longer matches the new handshake model.