A museum gift-shop AP is configured for TKIP-only WPA. What should the candidate recognize?
Select an answer to reveal the explanation.
Short Explanation
TKIP was the spare tire after WEP blew out — it got you to the shop, but you don't keep driving on it forever. Today's maps point to AES-based ciphers, not TKIP-only WPA.
Full Explanation
TKIP was introduced as a transitional integrity/encryption wrapper for early WPA when hardware could not yet mandate AES-CCMP everywhere. It is deprecated for modern production use; gift-shop or museum guest SSIDs should move to AES-based ciphers such as CCMP (and WPA3 where feasible). Candidates should recognize TKIP-only WPA as a legacy posture, not a current recommendation. Calling TKIP-only WPA the recommended cipher for all guest SSIDs contradicts modern guidance. Saying TKIP is identical to WPA3-SAE with no upgrade path conflates incompatible designs. Claiming TKIP only applies to Enterprise 802.1X and cannot appear on Personal SSIDs is historically false. Exam caveat: Beacon RSN/WPA IE inspection should call out TKIP when it remains enabled, including mixed modes that still permit it. Operational check: On the gift-shop AP, verify cipher suites in survey output; if TKIP-only or TKIP-preferred appears, record a deprecation finding and test remediation toward CCMP/WPA3 in a maintenance window. In civic WLAN stewardship, keep authorization boundaries explicit, prefer the least disruptive technique class allowed by RoE, and record BSSID, channel, band, and security mode beside every conclusion so another assessor can reproduce the observation.