Wireless security: WEP, WPA2, WPA3 and the settings that actually matter

Why this matters

Wireless security is one of the few places in this exam where the right answer has changed more than once and the wrong answers are still in circulation. A great deal of published advice — hide the network name, filter by hardware address — was never effective and is still repeated confidently.

So this lesson does two jobs: establish what the protocol generations actually provide, and be explicit about which commonly-recommended settings are worth nothing. Being able to say "that is not a security control, and here is what is" is a genuinely useful thing for a technician to be able to do, and the exam asks it directly.

The lesson

The protocol generations, what broke in each, and what to accept today

Four generations, and each one is defined by how the previous one broke.

WEP is broken beyond any use. The weakness is structural — the way it uses its initialisation vectors leaks key material — and a WEP key is recovered in minutes with ordinary tools. There is no configuration that makes WEP acceptable. If you find it, the answer is to replace the equipment or the configuration, not to lengthen the key.

WPA was the interim fix, using TKIP on the same hardware. It is also broken and should not be used.

WPA2 with AES-CCMP is the long-standing baseline and is still widely deployed. What broke in it: the four-way handshake was found to be replayable (the KRACK weakness, fixed by patching clients and access points), and — the structural problem — a WPA2-Personal network's traffic can be decrypted by anyone who knows the passphrase and captures a handshake. On a network where everyone has the same passphrase, everyone can read everyone else's traffic.

WPA3 fixes exactly that. It replaces the pre-shared key handshake with one that is resistant to offline guessing, and it gives each client its own session key, so knowing the passphrase does not let you read anyone else's traffic. It also encrypts open networks opportunistically.

What to accept today: WPA3 where every client supports it, WPA2/WPA3 transitional mode where they do not, WPA2-AES as the floor, and nothing older. And turn off WPS, which allows a PIN-based join that has a well-known brute-force weakness.

Personal against enterprise mode, and what a RADIUS server buys

The two modes answer different questions about who is joining.

Personal (pre-shared key) — one passphrase, shared by everyone. Simple, and it has three consequences: anyone who has it can join, revoking it means changing it for everyone, and under WPA2 anyone with it can decrypt other people's traffic.

Enterprise (802.1X) — each user authenticates individually against an authentication server, typically RADIUS, using their own credentials or a certificate.

What the RADIUS server buys:

• Per-user credentials. One person leaving means one account disabled, not a passphrase change across the building.
• Per-user session keys, so users cannot read each other's traffic.
• Accounting — a record of who connected, when, and from which access point.
• Policy — different users onto different networks, device posture checks, and time restrictions.

The cost is a server, certificates, and configuration on every client, which is why small sites stay on Personal and anything above about twenty users moves to Enterprise.

One detail the exam likes: with Enterprise, clients must validate the server's certificate, and clients configured not to can be lured onto a fake access point that harvests credentials. A deployment that skips certificate validation to make joining easier has removed the property that made it worth deploying.

The settings that are security theatre: hidden SSIDs and MAC filtering

Two settings are recommended constantly and are not security controls. Being able to explain why is worth more than knowing that.

Hiding the SSID stops the access point broadcasting its name in beacons. It does not hide the network: the name appears in every client's probe requests and in every association, so anyone listening sees it within moments of a client connecting. What it does achieve is making the network harder for legitimate users to join, and — the part people miss — it makes client devices noisier, because a device configured for a hidden network broadcasts that name wherever it goes, advertising where its owner works.

MAC filtering allows only listed hardware addresses. Addresses are sent in the clear in every frame and can be changed in software in seconds, so an attacker observes a permitted address and adopts it. Meanwhile the administrator maintains a list by hand, and every new device is a support call.

Both are sometimes defended as "defence in depth" or "it keeps the casual person out". The honest assessment is that they cost real administrative effort and real user friction in exchange for an obstacle that does not delay anyone capable of using the tools, and that effort is better spent on WPA3, a long passphrase, and a guest network.

Two others worth naming while we are here: reducing transmit power to limit range is marginally real and mostly impractical, and changing the channel is a performance setting with no security effect whatever.

Guest networks and isolation, which is the useful control people skip

The control that is genuinely valuable and frequently skipped is separating visitors from everything else.

A guest network is a separate wireless network that reaches the internet and nothing else. What makes it worth configuring:

• Visitors never touch the internal network, so a compromised visitor device cannot reach a file share, a printer's management page, or a workstation.
• The passphrase can be changed frequently without disturbing anyone.
• It gives a clean answer to the request that otherwise erodes every other control: "can I just have the wifi password?"

Client isolation (sometimes AP isolation) stops devices on the same wireless network from talking to each other at all. On a guest network this should be on. On a home network it breaks printing and casting, which is why it is not the default.

The related idea worth knowing for small networks: putting untrusted or un-updatable devices — cameras, televisions, smart plugs, anything whose vendor stopped shipping updates — on the guest network or on their own segment. Those devices are frequently the weakest thing on a small network, and they do not need to reach anything except the internet.

For the exam, the pattern to recognise: a scenario describing visitors, contractors, or personal devices needing internet access wants a guest network with isolation, not a shared passphrase and not a new access point.

Core 1 asks what the standard is; this asks what it protects and how it fails

The two A+ exams cover wireless from opposite ends, and knowing which end you are being asked about makes several questions easier.

Core 1 asks what the technology is: the standards and their generations, frequency bands, channels and channel width, range, interference, antenna placement, and which standard a device supports. Those are equipment questions.

This exam asks what protects it and how it fails: which security protocol, which mode, what happens when the passphrase is shared, which settings are theatre, and how a network is segmented. Those are configuration and judgement questions.

The practical overlap worth holding on to:

• A device that cannot join may be a capability problem (it does not support the band or the standard) or a security problem (it does not support WPA3, and the network is WPA3-only). Older devices — printers, consoles, instruments — routinely fail on the second, and transitional mode is the answer.
• Poor performance is a Core 1 question; poor performance only for guests is a configuration question about bandwidth limits on the guest network.
• A "network you cannot see" is a hidden SSID, which is a configuration choice, and the previous section says what to think of it.

If a question is about which standard is faster, it is asking about the technology. If it is about who can join and what they can reach once they have, it is asking about this domain — and the answer will be a protocol generation, a mode, or a separate network.