Public-works still has a few WPA2-only rugged tablets while newer crew phones support WPA3. Leadership enables WPA3 Transition Mode on the field SSID. What security tradeoff should the CWSP candidate emphasize versus SAE-only?
Select an answer to reveal the explanation.
Short Explanation
Transition Mode is the “both kinds of locks on the door” setting—old tablets still get in, but that means the weaker WPA2-PSK story can still haunt you. SAE-only is the clean break once the museum pieces retire.
Full Explanation
When public-works enables WPA3 Transition Mode because rugged tablets are still WPA2-only while newer phones support WPA3, the security tradeoff to emphasize is that mixed clients keep working while residual WPA2-Personal/PSK attack surface remains until legacy devices are gone. Transition Mode is a migration bridge, not the end-state security posture. CWSP candidates should explain that convenience for mixed fleets explicitly preserves weaker AKM options on the air during the transition window. Transition Mode does not immediately delete all WPA2 AKM suites from beacons so mixed tablets cannot associate—that would defeat the purpose of transition. It does not encrypt management frames with WEP while restricting data to GCMP-256 exclusively. It also does not replace RADIUS with a single global PSK on Enterprise SSIDs; confusing Transition Mode with Personal PSK redesign is a category error. Exam caveat: leaving Transition Mode enabled indefinitely is a common civic failure mode—track legacy client counts and set a forced SAE-only or WPA3-only date. Operational check: inventory which public-works devices still require WPA2 AKM, publish a retirement date, and periodically verify beacon AKM lists shrink as devices upgrade rather than remaining mixed forever.