Question 180
The team at a university campus has corrected this condition: A campus replaces a corporate 802.1X WLAN with one widely shared PSK because the new site is easier to deploy that way. Which preventive practice BEST addresses the identified mechanism?
Explanation
Correct Answer
Validate enterprise authentication requirements before choosing WLAN security modes. This repeatable safeguard addresses the mechanism—a universal PSK lacks enterprise identity-level revocation and attribution—and reduces the chance that the specific fault recurs.
Incorrect Answers
Include PMF negotiation in security acceptance and legacy-client compatibility testing. This protects against another issue—a network engineer disables protected management frames while deploying a WPA3 WLAN to improve compatibility—but is not the most direct prevention for a campus replaces a corporate 802.1X WLAN with one widely shared PSK because the new site is easier to deploy that way.
Include positive and negative certificate validation in 802.1X deployments. This protects against another issue—a site advertises WPA3-Enterprise but its RADIUS backend certificate cannot be validated by managed clients—but is not the most direct prevention for a campus replaces a corporate 802.1X WLAN with one widely shared PSK because the new site is easier to deploy that way.
Test each SSID's VLAN end to end after wired-port changes. This protects against another issue—an SSID authenticates clients but its local bridge VLAN is absent from the AP's switchport trunk—but is not the most direct prevention for a campus replaces a corporate 802.1X WLAN with one widely shared PSK because the new site is easier to deploy that way.