A municipal laptop Wi-Fi profile uses incorrect outer identity privacy settings during EAP. What identity-privacy awareness should IT apply?
Select an answer to reveal the explanation.
Short Explanation
Wrong outer-identity privacy is a chatty name tag on the air. Anonymous outer identities, when supported, cut username leakage during EAP—privacy settings do matter.
Full Explanation
Incorrect outer identity privacy settings on municipal laptop Wi-Fi profiles call for identity-privacy awareness: anonymous outer identities can reduce username leakage in EAP negotiations when the deployment supports them. Outer identity fields are transmitted in relevant flows, so privacy settings matter on PEAP and similar methods. Outer identity must not equal the user's plaintext password for RADIUS acceptance. Outer identity privacy does not disable all certificate validation by protocol design. Exam caveat: some AAA accounting requirements need correlatable identities—balance privacy with operational monitoring rather than blindly copying lab defaults. Operational check: pilot anonymous outer identity on a civic staff subset, confirm authentication and accounting still meet policy, and document the chosen outer-identity pattern in the WLAN standard. For municipal and campus engagements, keep the finding language tied to authorized scope, name the building or SSID class affected, and state the residual risk to residents or staff if the rejected option had been chosen. Re-validate after the next change window that the selected control still matches inventory, monitoring, and RoE abort criteria used by the city wireless program.