A clinic wants per-user accountability on staff Wi-Fi so departed employees can be revoked individually. Which model best fits?
Select an answer to reveal the explanation.
Short Explanation
If the whole clinic shares one Wi-Fi password, firing someone means changing the locks for everyone. Enterprise 802.1X is more like badge access — revoke one person without reprinting every key in the building.
Full Explanation
Per-user accountability and individual revocation on clinic staff Wi-Fi align with WPA2/WPA3-Enterprise using 802.1X, where each user authenticates distinctly through EAP methods backed by a directory or certificates. Departed employees can be disabled centrally without rotating a single passphrase on every remaining device. That model fits healthcare-adjacent civic clinics better than shared secrets or open portals. A single WPA2-Personal PSK posted in the break room maximizes convenience and minimizes accountability. An open SSID with a captive portal that never logs identities fails staff attribution. WEP with a yearly shared passphrase retains broken crypto and coarse rotation. Exam caveat: Enterprise improves identity but still needs validated server certificates and sound EAP method choices to resist evil-twin credential theft. Operational check: Confirm the staff SSID advertises 802.1X/Enterprise AKM, test disablement of a lab account, and verify that account can no longer associate while others continue working. In civic WLAN stewardship, keep authorization boundaries explicit, prefer the least disruptive technique class allowed by RoE, and record BSSID, channel, band, and security mode beside every conclusion so another assessor can reproduce the observation.