Transit-authority officers roam between platform APs while staying on a secure enterprise SSID. Which AKM-related construct specifically supports fast secure handoffs under 802.11r?
Select an answer to reveal the explanation.
Short Explanation
Full 802.1X every time you walk ten feet is like re-badgeing at every subway turnstile. 802.11r FT keeps a key hierarchy so the next AP can finish a fast, still-secure handshake instead of restarting the whole novel.
Full Explanation
Transit-authority officers who roam between platform APs on a secure enterprise SSID need an FT (802.11r) key hierarchy and related handshakes that allow secure roaming without a full reauthentication delay. Fast BSS transition keeps cryptographic continuity for latency-sensitive mobility so officers do not re-run the entire 802.1X novel at every pillar while still preserving secure keying. That AKM-related construct is specifically what CWSP candidates should map to “fast secure handoffs under 802.11r.” Disabling all pairwise ciphers so reassociation skips cryptography entirely trades latency for catastrophic confidentiality loss. Using only captive-portal cookies to prove identity at each new AP confuses application session state with link-layer AKM. Replacing FT with WEP shared-key authentication for voice latency is both deprecated and insecure for public-safety-adjacent transit operations. Exam caveat: FT must be supported end-to-end by clients, APs, and the key-holder architecture—enabling a controller checkbox without client support yields little benefit and confusing roam failures. Operational check: on a platform test path, compare full 802.1X reauthentication roam times against FT-enabled roams for a representative officer device and confirm voice or CAD sessions survive the handoff without dropping below the agency’s mobility SLA.