During a clinic AP review, a mixed mode still advertises a TKIP-only cipher suite. What should the technician conclude?
Select an answer to reveal the explanation.
Short Explanation
TKIP was the bandage after WEP, and the bandage is expired. If the clinic SSID still shows TKIP-only, steer the config to CCMP/AES and retire that mixed leftover.
Full Explanation
During a clinic AP review, a mixed mode that still advertises a TKIP-only cipher suite should be rejected. The technician should treat TKIP as deprecated and prefer CCMP/AES cipher suites instead. TKIP was a transitional integrity/encryption design and is no longer acceptable as the sole or preferred cipher on municipal clinic WLANs that may handle sensitive operational traffic.
Preferring TKIP-only for voice handsets to reduce AES CPU load is an outdated performance myth relative to modern APs and security requirements. Requiring TKIP-only whenever any Windows XP embedded kiosk remains is a compatibility trap that should be redesigned, not used to freeze weak ciphers. Accepting TKIP-only if the PSK is longer than sixteen characters confuses passphrase length with cipher strength.
Exam caveat: TKIP-only advertisements are rejectable; CCMP/AES is the modern cipher expectation.
Operational check: remove TKIP-only suites on the clinic AP, configure CCMP/AES under WPA2/WPA3, retest handsets and kiosks, and escalate true incompatible devices for replacement rather than retaining TKIP. Municipal technicians document the verified setting in the as-built packet so the next shift inherits a known-good civic configuration rather than tribal knowledge.