CCNP Infrastructure Practice Question
A network engineer is deploying a new WLAN and needs to ensure that client traffic is encrypted using AES with a pre-shared key. Which security configuration should be applied to the wireless SSID?
⚠ Common exam trap
Candidates may mistakenly think that WPA3-PSK is a valid term because WPA3 uses AES and a pre-shared key (password). However, the industry-standard name is WPA3-Personal (which uses SAE for key exchange), not WPA3-PSK. The option 'WPA3-PSK with AES' is incorrect due to non-standard terminology, while WPA2-PSK with AES fully meets the need for AES encryption and PSK authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
WPA2-PSK with AES
WPA2-PSK with AES is the correct choice because the requirement specifies AES encryption with a pre-shared key. WPA2-PSK (Wi-Fi Protected Access 2 – Pre-Shared Key) mandates AES-CCMP (Counter Mode Cipher Block Chaining Message Authentication Code Protocol) as the encryption protocol, providing strong, standards-compliant security for client traffic. This configuration directly satisfies the need for both AES encryption and PSK authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
WPA2-PSK with AES
Why this is correct
WPA2-PSK with AES-CCMP is the appropriate choice because it offers robust wireless encryption (AES in counter mode with CBC-MAC) and uses a pre-shared key for straightforward authentication. This configuration is widely supported, passes PCI DSS requirements for strong encryption, and fulfills the stated requirement of using AES-based security. It balances compatibility with strong protection.
- ✗
WPA3-PSK with AES
Why it's wrong here
WPA3-PSK is not a valid term because WPA3-Personal replaces the pre-shared key mechanism with Simultaneous Authentication of Equals (SAE), which eliminates offline dictionary attacks by performing a shared-password authentication using a Dragonfly key exchange. Even though WPA3 provides AES-based encryption (GCMP-256), the authentication is not PSK, so labeling it as WPA3-PSK is incorrect. Additionally, WPA3 requires support from both the AP and clients, which may not be present in a mixed legacy environment.
- ✗
WPA2-PSK with TKIP
Why it's wrong here
WPA2-PSK with TKIP is not acceptable because TKIP (Temporal Key Integrity Protocol) uses the RC4 stream cipher and was designed as a stopgap for WEP vulnerabilities; it does not employ AES. While WPA2 permits TKIP for legacy interoperability, it lacks the cryptographic strength of AES-CCMP and is deprecated in modern networking standards. Therefore, this would contradict the requirement for AES encryption.
- ✗
WEP with AES
Why it's wrong here
WEP with AES is an invalid combination because Wired Equivalent Privacy (WEP) is a legacy, broken security protocol that relies on RC4 with static keys and cannot support AES. AES is implemented in the 802.11i amendment via CCMP/AES-GCMP, and is only available in WPA2/WPA3. Thus this option is not even a possible configuration and would provide trivial security.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.