A town clerk’s office uses one Wi-Fi passphrase for every inspector laptop under WPA2/WPA3-Personal. Where does that design place the pre-shared key in AKM terms, and what operational risk follows at municipal scale?
Select an answer to reveal the explanation.
Short Explanation
One passphrase for the whole clerk’s office is like one brass key for every filing cabinet in city hall—lose it once and the neighborhood is open. That’s Personal-mode PSK AKM, and it scales badly when dozens of inspectors share the secret.
Full Explanation
When a town clerk’s office uses one Wi-Fi passphrase for every inspector laptop under WPA2/WPA3-Personal, that pre-shared key is a shared Personal-mode secret. Compromise, guessing, or casual reuse across many devices exposes the whole SSID community of trust because every peer effectively shares the same door key. At municipal scale, that AKM model creates revocation pain, audit findings, and blast-radius problems whenever one laptop, sticky note, or former contractor still knows the passphrase. The PSK is not a per-session RADIUS certificate that automatically rotates after each association—that description belongs to Enterprise certificate thinking, not Personal PSK. The PSK is not limited to management-frame encryption and excluded from unicast key derivation; Personal AKM participates in establishing the keys that protect unicast data. The PSK is also not an Enterprise AKM that binds each laptop to a unique Active Directory user object. Exam caveat: moving to WPA3-Personal SAE improves handshake resistance but does not remove the shared-secret operational risk if the same passphrase is still issued to dozens of inspectors without rotation or offboarding discipline. Operational check: inventory how many clerk devices share the Personal passphrase, check offboarding records for last rotation, and propose either Enterprise 802.1X for inspectors or unique per-device credentials if Personal mode must remain temporary.