An intern asks whether WPA3-Enterprise always requires EAP-TLS on city staff Wi-Fi. What is the accurate clarification?
Select an answer to reveal the explanation.
Short Explanation
Enterprise means badge-and-gate via 802.1X—not one single brand of badge. EAP-TLS is a gold-standard method, but other EAP methods can still appear depending on policy. 192-bit mode is the stricter dress code, not proof that every city must run TLS exclusively.
Full Explanation
WPA3-Enterprise still centers on 802.1X/EAP, but EAP method choices vary—EAP-TLS is common for high assurance, yet other tunneled methods may appear depending on policy. The 192-bit mode profile is a stricter cryptographic suite selection, not a slogan that means “TLS only forever” on every city staff SSID. Interns should separate Enterprise architecture from a single mandatory inner method myth. Saying WPA3-Enterprise forbids PEAP and permits only pre-shared keys stamped into beacons contradicts Enterprise design. Claiming it removes 802.1X entirely and relies on SAE-PK for all staff laptops confuses Personal enhancements with Enterprise. Asserting any WPA3-Enterprise SSID must disable certificates and use MSCHAPv2 without tunneling recommends a weakened pattern. Exam caveat: Method choice and certificate validation quality dominate Enterprise evil-twin resistance. Operational check: Read the staff SSID’s EAP method from configuration and a controlled lab authentication, and verify whether 192-bit mode is actually required by policy or optional. In civic WLAN stewardship, keep authorization boundaries explicit, prefer the least disruptive technique class allowed by RoE, and record BSSID, channel, band, and security mode beside every conclusion so another assessor can reproduce the observation.