A university is upgrading its campus Wi-Fi to support student and faculty devices. The network team wants to use a single SSID that supports both personal and enterprise authentication, while ensuring data confidentiality and integrity through AES-CCMP. Which approach meets these requirements?

Configure WPA3-Personal with SAE

Configure WPA with TKIP and 802.1X

Configure WPA2-Enterprise with 802.1X and AES-CCMP

Configure WPA2-PSK for all users

A network administrator is configuring a wireless network for a small business. The business owner wants to ensure that the network is secure but also wants to avoid the complexity of a RADIUS server. Which configuration is most appropriate?

WPA3-Enterprise with 192-bit mode

A small business is still using an older wireless router that only supports WPA with TKIP. The owner wants to understand the security implications before replacing it. Which statement accurately describes TKIP's operation and its current status?

TKIP uses AES-CCMP for encryption and is fully secure

TKIP is identical to WPA2 but with a different name

TKIP is a modern protocol that is recommended for new deployments

TKIP provides per-packet key mixing and a message integrity check, but it is deprecated due to known weaknesses

A network engineer is explaining to a client why WPA2 is more secure than the older WPA. The client asks how AES-CCMP provides both confidentiality and integrity. What is the correct explanation?

AES-CCMP only provides encryption, not integrity

AES-CCMP is a block cipher that does not support authentication

AES-CCMP uses the same key for encryption and authentication, which is less secure

AES-CCMP uses separate keys for encryption and authentication, combining Counter Mode for confidentiality and CBC-MAC for integrity

A hospital is deploying a new Wi-Fi network for IoT medical devices that only support WPA2. The security team wants to ensure that the network is as secure as possible while maintaining compatibility. Which configuration should they use?

WPA2-Enterprise with 802.1X and TKIP

CCIE Security

Domain 3Objective 5

3.5 Wireless Security Technologies CCIE-SECURITY Practice Questions (Page 7)

Part of the 3.0 Security Infrastructure domain, which accounts for 15% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

10concepts

15%of the exam

Questions 31–35

31application · medium
A university is upgrading its campus Wi-Fi to support student and faculty devices. The network team wants to use a single SSID that supports both personal and enterprise authentication, while ensuring data confidentiality and integrity through AES-CCMP. Which approach meets these requirements?
Select an answer first
32expert · medium
A network administrator is configuring a wireless network for a small business. The business owner wants to ensure that the network is secure but also wants to avoid the complexity of a RADIUS server. Which configuration is most appropriate?
Select an answer first
33application · medium
A small business is still using an older wireless router that only supports WPA with TKIP. The owner wants to understand the security implications before replacing it. Which statement accurately describes TKIP's operation and its current status?
Select an answer first
34application · medium
A network engineer is explaining to a client why WPA2 is more secure than the older WPA. The client asks how AES-CCMP provides both confidentiality and integrity. What is the correct explanation?
Select an answer first
35application · medium
A hospital is deploying a new Wi-Fi network for IoT medical devices that only support WPA2. The security team wants to ensure that the network is as secure as possible while maintaining compatibility. Which configuration should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.