Security & Compliance
This domain tests WLAN security mechanisms, threats, and the compliance obligations that shape wireless policy. Questions compare WEP, WPA, WPA2, and WPA3, distinguish personal and enterprise modes, and identify rogue devices and policy controls.
Security rules
- WEP is broken and must not be used. WPA used TKIP and is deprecated. WPA2 uses AES-CCMP and implements the 802.11i robust security network. WPA3 adds SAE for personal networks, OWE for open networks, and protected management frames.
- Personal mode uses a pre-shared key. Enterprise mode uses 802.1X with an EAP method and a RADIUS server; it supports per-user credentials and certificates. 802.1X is authentication, while the cipher suite protects data. RADIUS uses a shared secret; EAP-TLS uses certificates on both sides, while PEAP commonly uses only a server certificate.
- Threats include rogue APs, evil twins, ad hoc networks, eavesdropping, MAC spoofing, and denial of service. A WIPS can detect and contain rogue devices; a WIDS detects but does not contain.
- Compliance frameworks such as PCI DSS, HIPAA, and GDPR require controls, not a specific vendor. PCI DSS prohibits WEP and requires strong encryption for cardholder data. Guest networks should be segmented from internal resources. Policy should cover acceptable use, guest access, onboarding, monitoring, and incident response.
Worked example
A retail site uses WEP with a shared key and must meet PCI DSS. Reasoning: WEP fails the encryption requirement. Replace it with WPA2 or WPA3-Enterprise using 802.1X and AES, segment guest traffic, and document the configuration. Turning off SSID broadcast does not fix the issue.
Traps
Do not treat a hidden SSID or MAC filtering as real security. Do not confuse WPA2-Personal with WPA2-Enterprise. Do not assume WPA3 works on legacy clients without checking capability. Do not claim compliance because a product is installed; policy and configuration matter.