Encryption, Certificates, and Secure Management Access
Cryptographic foundations
Know symmetric vs. asymmetric roles: asymmetric for key exchange and signatures, symmetric for bulk data. TLS combines both. Understand certificate anatomy - subject, issuer, SAN, validity, key usage, chain of trust - and the difference between a self-signed certificate and one signed by an internal or public CA. For EAP, the server certificate must be trusted by the supplicant and should match the configured server name; mismatches cause silent failures.
Wireless encryption
WPA2-Personal uses a PSK; WPA2-Enterprise uses 802.1X with per-session keys. WPA3 introduces SAE (resistant to offline dictionary attacks) and, in enterprise mode, protected management frames and stronger handshakes. PMF protects against deauth/disassociation forgery. Know that open networks with captive portals provide no link-layer encryption.
Secure management
Use SSH/HTTPS, disable Telnet/HTTP, restrict management by ACL and role, and protect credentials in configuration backups. Certificate expiry is a classic outage cause - monitor it.
Traps
Questions conflate authentication of the server with authentication of the client. In PEAP the client validates the server; the client is validated by inner credentials. Also watch for claims that WPA3 fixes rogue APs entirely - it mitigates, not eliminates, and only with PMF and proper validation.
Rule of thumb
If the supplicant cannot validate the server certificate, the client is trusting whoever answers - treat that as a design defect.