An auditor reviewing a municipal RSN profile asks what 'group cipher' versus 'pairwise cipher' means at a high level. What is the correct contrast?
Select an answer to reveal the explanation.
Short Explanation
Unicast is the private hallway between one laptop and the AP—that is the pairwise key. Broadcast is the building loudspeaker—that needs the group key. Mix those up and you misread what confidentiality actually covers.
Full Explanation
In RSN, pairwise ciphers protect unicast traffic between a client and the AP using pairwise transient keying, while group ciphers protect broadcast and multicast frames using group keys. Auditors reviewing municipal profiles should keep that unicast-versus-group contrast clear when reading beacon cipher lists and troubleshooting which traffic class fails integrity checks. Saying group ciphers encrypt only EAP identity exchanges while pairwise encrypt DHCP only invents application-layer carve-outs. Claiming pairwise protects management beacons while group protects association requests misassigns frame classes. Calling group and pairwise interchangeable labels for the same unicast PTK collapses distinct key hierarchies. Exam caveat: Misconfigured group ciphers can break multicast services even when unicast browsing appears fine. Operational check: From an authorized client on a city SSID, verify unicast works and then test a multicast/broadcast dependent service, correlating failures with group-cipher settings in the controller profile. In civic WLAN stewardship, keep authorization boundaries explicit, prefer the least disruptive technique class allowed by RoE, and record BSSID, channel, band, and security mode beside every conclusion so another assessor can reproduce the observation.