Compare four wireless security modes on one network
Task
Configure an access point through each of WPA2-Personal, WPA2-Enterprise, WPA3-Personal and an open network, and record what changes for the client and for an observer. The security modes are examined as differences, and this is the fastest way to hold them apart.
Steps
- Set the AP to open with no security. Connect a client and note what the client warns you about. This mode has exactly one legitimate use — a captive portal guest network — and even then the traffic is unencrypted.
- Set it to WPA2-Personal (PSK). Note that every client shares one passphrase, which means a departing employee takes the network key with them and that any client who knows the key can derive another client's session key if they captured the four-way handshake.
- Set it to WPA3-Personal (SAE). Note the two changes that matter: Simultaneous Authentication of Equals removes the offline dictionary attack on a captured handshake, and forward secrecy means a later key disclosure does not decrypt earlier traffic.
- Describe WPA2/WPA3-Enterprise. Each user authenticates individually against a RADIUS server with 802.1X, so there is no shared key, revoking one user revokes one user, and every session has its own key.
- Write a one-line recommendation for each of: a guest network, a staff network in a 12-person office, a staff network in a 600-person company, and a network of IoT sensors that only support WPA2.
Verify
sudo iw dev wlan0 link
sudo iw dev wlan0 scan | grep -E "SSID|RSN|WPA|capability" | head -20
python3 -c "
rec = {'guest':'Open with captive portal, isolated VLAN, no route to internal',
'12-person office':'WPA3-Personal, or WPA2-PSK with a long unique passphrase',
'600-person company':'WPA2/WPA3-Enterprise with 802.1X and RADIUS -- per-user revocation',
'WPA2-only IoT':'Separate SSID and VLAN, WPA2-PSK, no route to anything it does not need'}
for k, v in rec.items(): print(f'{k:<20}{v}')
"iw dev wlan0 link reports the active connection and its cipher. The scan output shows an RSN block for WPA2/WPA3 networks and none for open ones — that block's presence is the machine-readable difference between the modes.
Notes
The IoT recommendation is the one that reflects real practice. You cannot upgrade devices that do not support WPA3, and refusing to deploy them is rarely an option, so the answer is segmentation: a separate SSID mapped to a separate VLAN with a firewall policy that lets the sensors reach only their controller.
Two more things the exam asks about. WPS should be disabled — its PIN is brute-forceable in hours regardless of how strong the passphrase is. And MAC filtering and SSID hiding are not security controls; a MAC is trivially spoofed and a hidden SSID is broadcast by every client looking for it.