A municipal CIO asks which Wi-Fi Alliance security generation should be treated as deprecated when selecting AKM for new city-hall SSIDs, relative to WPA2 and WPA3.
Select an answer to reveal the explanation.
Short Explanation
WPA was the transitional seatbelt after WEP—better than nothing, not what you spec for a new city-hall SSID. Treat classic WPA as retired scenery; design on WPA2/WPA3 generations instead.
Full Explanation
When a municipal CIO asks which Wi-Fi Alliance security generation should be treated as deprecated for new city-hall SSIDs relative to WPA2 and WPA3, the correct answer is original WPA (and its TKIP-era Personal/Enterprise practice). Classic WPA was a transitional improvement after WEP, not the baseline for contemporary civic designs. New AKM and cipher selections should target WPA2/WPA3 generations; treating original WPA as current invites TKIP-era weaknesses back into city hall. WPA3-Personal SAE is not older than WPA2-PSK and is not the deprecated generation in this comparison. WPA2-Enterprise was not withdrawn when WPA3 shipped; it remains widely deployed and is not “deprecated” in the same sense as original WPA/TKIP practice. GCMP-256 is not disallowed on civic networks merely because it is AES-based; AES-based modern ciphers are desired, not banned. Exam caveat: some environments still have WPA2 for compatibility, but exam framing about deprecated generations points at original WPA/TKIP—not at refusing WPA3 migration planning. Operational check: scan city-hall SSID advertisements and configuration templates for residual WPA/TKIP options, remove them from new SSID classes, and record exceptions only on isolated, time-boxed legacy networks.