A county IT desk still has many staff laptops that only support WPA2-Enterprise, while a few new devices already offer WPA3. Leadership wants a modern secure SSID for city hall without jumping straight to WEP or WPA1-era settings. Which choice best matches technician guidance during the transition?
Select an answer to reveal the explanation.
Short Explanation
WPA2-Enterprise is still in the modern secure club when the fleet cannot all do WPA3 yet. Think of it as a solid deadbolt while you stage the newer locks—not a return to WEP’s cardboard latch. Skip the legacy TKIP/WPA1 nostalgia and the “hide SSID” theater.
Full Explanation
For a county IT desk whose staff laptops still only support WPA2-Enterprise while a few newer devices already offer WPA3, the correct transitional stance is to configure a modern secure staff SSID with WPA2-Enterprise (802.1X and AES-class ciphers) and plan WPA3-Enterprise upgrades as the client fleet catches up. CWTS-level guidance treats WPA2-Enterprise with contemporary ciphers as an acceptable modern secure option when WPA3 is not yet universal. That choice keeps city-hall staff authentication on a strong, managed path without forcing an overnight fleet break or regressing to obsolete suites.
Keeping WEP on the staff SSID until every laptop is replaced fails because WEP is cryptographically broken and is never an acceptable holding pattern for municipal staff traffic. Forcing WPA-Personal with TKIP so older and newer clients share one weak legacy cipher fails by concept: Personal/TKIP is not Enterprise 802.1X, and TKIP is a deprecated cipher path rather than a modern secure baseline. Hiding the SSID and relying on MAC filtering as the only staff security control fails because neither SSID hiding nor MAC lists provide encryption or strong authentication; they are weak obscurity measures that attackers trivially bypass.
Exam caveat: CWTS items often contrast “modern secure” (WPA2/WPA3 with AES/CCMP and Enterprise where required) against legacy traps (WEP, WPA-TKIP, open/MAC-only). Transition planning is valid; regressing to WEP is not.
Operational check: inventory staff client WPA3 capability; configure the civic staff SSID as WPA2-Enterprise with AES/CCMP now; document a WPA3-Enterprise cutover when the remaining WPA2-only laptops are replaced or upgraded; verify a sample laptop completes 802.1X and shows CCMP—not WEP or TKIP—in the connection details.