WLAN Security Architecture
The chain of trust
Enterprise WLAN security has three roles: supplicant (client), authenticator (AP or controller) and authentication server (usually RADIUS). 802.1X/EAP carries credentials; the EAP method decides the strength. EAP-TLS uses certificates on both sides and is strongest; PEAP and EAP-TTLS build a TLS tunnel and then authenticate the user with MSCHAPv2 or similar, so server-certificate validation on the client is the critical control. After authentication, the 4-way handshake derives the PTK and distributes the GTK; the PMK comes from the 802.1X exchange or, in personal mode, from the passphrase and SSID.
Standards progression
WEP used RC4 with a 24-bit IV and is trivially broken. WPA introduced TKIP, now deprecated. WPA2 mandates CCMP/AES and is still widely deployed. WPA3 replaces the PSK handshake with SAE, which resists offline dictionary attacks, adds forward secrecy, and makes management frame protection (802.11w) mandatory; WPA3-Enterprise offers a 192-bit suite. OWE provides unauthenticated encryption on open networks. Enhanced Open, captive portals, guest VLANs and client isolation handle visitor traffic.
Traps
Questions mix up which key is which, assume a hidden SSID is a security control, or claim WPA2-PSK resists offline cracking (it does not - capture the handshake and attack the passphrase). Another trap is forgetting that 802.11w protects only management frames, not data. Rogue AP detection, WIPS, evil-twin and deauth-flood awareness belong to the architecture, not just to operations. Fast roaming (802.11r, OKC, PMK caching) is a security-relevant design choice because it trades key-exchange overhead for handoff speed.
Rule of thumb
If a question mentions certificates, think EAP-TLS; if it mentions a shared passphrase, think PSK/SAE; if it mentions per-user accounting or VLAN assignment from a server, think RADIUS attributes.