CISSP Communication and Network Security Practice Question
A network administrator is deploying a wireless network for a small business and wants to ensure strong security. Which of the following is the best choice for authentication in a WPA3 Personal network?
⚠ Common exam trap
Watch out — candidates often confuse WPA2 Personal (PSK) with WPA3 Personal, assuming PSK is still acceptable, but the exam expects you to know that WPA3 Personal mandates SAE as the authentication method, not PSK.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Simultaneous Authentication of Equals (SAE)
Simultaneous Authentication of Equals (SAE) is the correct choice because WPA3 Personal replaces the vulnerable Pre-Shared Key (PSK) handshake with SAE, which provides a secure key exchange resistant to offline dictionary attacks. SAE uses a Dragonfly handshake based on a zero-knowledge proof, ensuring that even if an attacker captures the handshake, they cannot brute-force the password without being present for each guess.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
EAP-TLS
Why it's wrong here
EAP-TLS (Extensible Authentication Protocol - Transport Layer Security) is a robust, certificate-based authentication method primarily used in WPA2/WPA3-Enterprise networks. It requires both the server and client to possess valid digital certificates for mutual authentication, providing strong security. However, its complexity and the overhead of certificate management make it impractical and generally not deployed for typical small office/home office (SOHO) or 'personal' wireless network scenarios.
- ✗
TKIP
Why it's wrong here
TKIP (Temporal Key Integrity Protocol) was introduced as an interim solution with WPA to mitigate vulnerabilities found in WEP, providing per-packet keying and message integrity. Despite its initial purpose, TKIP has known cryptographic weaknesses, including susceptibility to various attacks such as the ChopChop attack and key recovery. Consequently, it is considered a deprecated encryption protocol and is explicitly disallowed or strongly discouraged in modern secure wireless deployments like WPA3.
- ✓
Simultaneous Authentication of Equals (SAE)
Why this is correct
Simultaneous Authentication of Equals (SAE) is the foundational key exchange mechanism for WPA3-Personal, replacing the less secure Pre-Shared Key (PSK) handshake used in WPA2-Personal. SAE employs a robust password-authenticated key exchange (PAKE) protocol that establishes a strong cryptographic key without directly exposing the shared secret. This design provides crucial protection against offline dictionary attacks and ensures forward secrecy, meaning past session traffic remains confidential even if the shared password is later compromised.
- ✗
Pre-shared key (PSK)
Why it's wrong here
Pre-shared key (PSK) is the authentication method used in WPA2-Personal, where a single passphrase is known to both the access point and all authorized clients. While widely adopted, the WPA2-PSK four-way handshake is vulnerable to offline dictionary attacks. An attacker can capture the handshake and then repeatedly guess the passphrase offline, verifying each guess against the captured data, making it an inferior choice for modern security requirements compared to WPA3's SAE.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.