WLAN engineers must choose trust anchors for RADIUS server certificates used by city EAP clients. Which design choice is most accurate?
Select an answer to reveal the explanation.
Short Explanation
Clients need a trust map to the real RADIUS server the way browsers need a path to a website’s CA. Whether the city runs a private CA or uses a public one, that chain has to be intentional and installable on endpoints. Fake-looking SSIDs and MAC lists are not a PKI plan.
Full Explanation
EAP deployments depend on clients validating the AAA server certificate against configured trust anchors. Enterprises often use a private CA for RADIUS and client certs, or carefully scoped public certificates, but the chain must be designed and distributed. Self-signed AP certs, MAC filtering, or expired certificates undermine that trust model.