Wired and Wireless Security Configuration
Core concepts
On the wireless side, know the WPA2/WPA3 progression. WPA2-PSK uses a shared passphrase; WPA2-Enterprise uses 802.1X. WPA3 introduces SAE (Simultaneous Authentication of Equals), which resists offline dictionary attacks on captured handshakes, and offers optional 192-bit enterprise mode. Know PMF (protected management frames), which defends against deauthentication and disassociation spoofing, and is mandatory in WPA3.
On the wired side, know port security, DHCP snooping, dynamic ARP inspection, and BPDU guard as Layer 2 hardening. Understand that these protect against MAC flooding, rogue DHCP servers, ARP spoofing, and spanning-tree manipulation respectively.
Traps to watch
- WPA3 does not make WPA2-PSK obsolete overnight; transition mode allows both, and questions test whether you know SAE replaces the PSK four-way handshake's weakness.
- PMF defends against forged deauth frames, not against weak passphrases.
- Port security limits MACs per port; it does not authenticate users.
- DHCP snooping requires trusted ports; the uplink to the real DHCP server must be trusted or clients get no address.
Rule of thumb
Match the attack to the L2 feature: MAC flooding → port security; rogue DHCP → DHCP snooping; ARP spoofing → dynamic ARP inspection; STP attack → BPDU guard. Memorize this pairing; it answers most configuration questions.
Worked example
Users report random disconnects on a WPA2 network; a forged deauth flood is suspected. Enable PMF on the SSID to protect management frames, and consider WPA3 where clients support it.