A PEAP deployment for county staff omits the validate server certificate option on endpoints. What misconfiguration class does that create?
Select an answer to reveal the explanation.
Short Explanation
Unchecked 'validate server certificate' is a welcome mat for a look-alike PEAP twin. That misconfig class makes credential harvesting much easier—not SAE mode, WEP wrapping, or free anonymity.
Full Explanation
Omitting the validate server certificate option on county PEAP endpoints creates a misconfiguration class that makes evil-twin credential harvesting far easier, because clients will tunnel to a rogue authenticator presenting almost any certificate. The setting does not force WPA3-SAE Personal mode or disable 802.1X entirely. It does not encrypt MSCHAPv2 with WEP before the TLS tunnel starts. It does not automatically enable anonymous outer identities for every user. Exam caveat: this is one of the highest-impact Enterprise client hygiene failures in civic deployments using password inner methods. Operational check: audit PEAP profiles at scale, remediate missing validation, and retest with an authorized lookalike AAA to prove staff laptops refuse untrusted presenters. For municipal and campus engagements, keep the finding language tied to authorized scope, name the building or SSID class affected, and state the residual risk to residents or staff if the rejected option had been chosen. Re-validate after the next change window that the selected control still matches inventory, monitoring, and RoE abort criteria used by the city wireless program. Document the decision in the municipal engagement notes so the next assessor inherits both the technical rationale and the civic constraints that shaped it.