Objective 4.1: Given a scenario, apply common security techniques to computing resources
Security+ SY0-701 practice question
A medical clinic is replacing the Wi-Fi network used by staff laptops. The practice manager wants every employee to connect with their own directory credentials, so that one person's access can be revoked without changing settings on anyone else's device. Which configuration BEST meets this requirement?
- WPA3-Personal with a strong passphrase that is changed every quarter
WPA3-Personal uses SAE for authentication and key exchange, which resists offline passphrase guessing, but everyone still shares the same passphrase. Revoking one employee means changing the passphrase for all users, which is exactly what the manager wants to avoid.
- WPA2-Personal with MAC address filtering
WPA2-Personal also relies on a shared passphrase, and MAC filtering is easily bypassed by spoofing an allowed MAC address. Neither element provides per-user directory authentication.
- WPA3-Enterprise using 802.1X authentication against a RADIUS server(Correct)
Correct. WPA3-Enterprise with 802.1X and RADIUS authenticates each employee with their own directory account, so disabling that one account removes that person's Wi-Fi access.
- An open network with a captive portal that displays the acceptable use policy
An open network with a captive portal provides no per-user authentication or over-the-air encryption for staff devices; displaying a policy page is not access control.
Explanation
Enterprise mode Wi-Fi uses 802.1X, so each user authenticates individually, usually through a RADIUS server tied to the directory. Access can then be granted, logged, and revoked per person. Personal mode uses one shared passphrase for everyone, so removing one person means changing the passphrase on every device.