WLAN Security
Domain 4 tests the security chain from the wireless cipher to authentication, authorization and accounting, including certificates and guest access.
Encryption evolution
WEP uses RC4 with weak IVs and is deprecated. WPA introduced TKIP as a stopgap. WPA2 uses CCMP/AES and is still common. WPA3 adds SAE for personal networks, mandatory PMF and OWE for open networks. WPA3 transition mode permits WPA2 clients during migration, which weakens the WPA3-only guarantee.
Enterprise and guest
802.1X carries EAP between supplicant and RADIUS server. EAP-TLS uses certificates on both sides; PEAP/MSCHAPv2 normally validates only the server certificate. PKI issues and renews server and client certificates. Portal authentication redirects a browser to a login page; MAC authentication uses the client MAC as the credential and is easily spoofed, so it is a convenience or fallback, not strong security.
Worked example: a corporate SSID uses WPA2/WPA3-Enterprise with EAP-TLS. The client trusts the RADIUS server certificate from the corporate CA, presents its own certificate, and the RADIUS server returns Accept with VLAN attributes. A guest SSID uses portal login with MAC bypass for printers; the portal provides access control, while WPA2/WPA3 provides over-the-air encryption.
Traps: treating a captive portal as encryption; leaving WEP enabled; assuming WPA3 transition mode equals WPA3-only; forgetting that PMF is mandatory in WPA3 but optional in WPA2; using MAC authentication as strong identity.