A library asks what WPA2-Personal actually shares among authorized users on the staff SSID. What is accurate?
Select an answer to reveal the explanation.
Short Explanation
Personal mode is the house key under the mat — everyone allowed in uses the same passphrase knowledge. Nice for small shops; rough when you need to know exactly whose key opened the door.
Full Explanation
WPA2-Personal (PSK) authorizes users who know a shared passphrase. Anyone with that passphrase can derive the material needed to access the BSS under that model, so library staff SSIDs using one PSK share fate: disclosure, former employees, and unchecked posting all expand the trusted set. Accountability is collective rather than per-user. Claiming each Personal user receives a unique RADIUS-issued certificate describes Enterprise 802.1X, not PSK. Saying nothing is shared and Personal mode generates per-user public keys with no common secret misstates PSK design. Asserting Personal mode shares only the SSID string while keys are globally hard-coded in every AP is incorrect. Exam caveat: Captured WPA2-PSK handshakes enable offline passphrase guessing—rotate and lengthen PSKs, and prefer Enterprise when revocation matters. Operational check: Inventory who knows the staff PSK, check beacon AKM for PSK, and if individual revoke is required, plan migration to 802.1X rather than endless shared-secret redistribution. In civic WLAN stewardship, keep authorization boundaries explicit, prefer the least disruptive technique class allowed by RoE, and record BSSID, channel, band, and security mode beside every conclusion so another assessor can reproduce the observation.