A city compares CCMP and TKIP on a dual-mode park AP that still serves modern clients. Which cipher preference should the assessor recommend when interoperability allows?
Select an answer to reveal the explanation.
Short Explanation
TKIP was the spare tire after WEP blew out; CCMP/AES is the real wheel. If every city laptop can roll on CCMP, take TKIP off the axle. Dual-mode nostalgia just keeps a weaker tool in the toolbox.
Full Explanation
When a dual-mode park AP still serves modern clients, assessors should prefer CCMP/AES as the modern WPA2 cipher and disable TKIP whenever interoperability allows. Keeping TKIP available invites negotiation of a deprecated suite and weakens the municipal baseline even if many clients would have chosen CCMP. Cipher preference is an active configuration choice, not a coin flip per frame. Preferring TKIP because it predates CCMP and is “more audited” reverses modern guidance. Keeping both ciphers equal so each client randomly selects per frame is not how robust baselines are built. Disabling CCMP to rely on TKIP MIC alone for compliance is backward. Exam caveat: Mixed TKIP/CCMP advertisements are a common finding—push AP profiles to CCMP-only. Operational check: Inspect the park AP cipher list, disable TKIP in a maintenance window, and verify modern clients still associate while survey output no longer offers TKIP. In civic WLAN stewardship, keep authorization boundaries explicit, prefer the least disruptive technique class allowed by RoE, and record BSSID, channel, band, and security mode beside every conclusion so another assessor can reproduce the observation. In civic WLAN stewardship, keep authorization boundaries explicit, prefer the least disruptive technique class allowed by RoE, and record BSSID, channel, band, and security mode beside every conclusion so another assessor can reproduce the observation.