A small municipal clinic wants one shared passphrase on every staff iPad for a single clinic SSID. Which client security mode matches that request?
Select an answer to reveal the explanation.
Short Explanation
One passphrase on every iPad is Personal/PSK territory—like one key for the clinic break-room door. Enterprise wants usernames and 802.1X, not a shared clinic password. VPN and captive portal are different tools.
Full Explanation
A small municipal clinic that wants one shared passphrase on every staff iPad for a single clinic SSID is describing WPA2/WPA3-Personal (PSK) behavior. Personal mode uses a shared passphrase for the BSS: every clinic iPad receives the same PSK in its client profile. That model fits intentionally small civic deployments where per-user 802.1X identity is not required and operational simplicity outweighs individual credential revocation.
WPA2/WPA3-Enterprise with per-user 802.1X credentials contradicts the request for one shared passphrase; Enterprise expects usernames, certificates, or device identities via EAP. Open system authentication with captive-portal tickets addresses web-layer guest access, not a shared PSK for encrypted staff iPad association. IPsec VPN profiles protect traffic after a network path exists; they do not replace 802.11 Personal/Enterprise encryption for joining the clinic SSID.
Exam caveat: Personal versus Enterprise is selected by authentication architecture, not by whether the site is 'government'—a tiny clinic PSK SSID can still be Personal if policy accepts shared keys. Operational check: configure an iPad with WPA2/WPA3-Personal and the shared clinic passphrase, confirm association, and document passphrase rotation procedure because shared keys affect every device when changed.