mediumMultiple SelectObjective-mapped
CISSP Practice Question: Which two methods provide strong encryption and…
Which two methods provide strong encryption and authentication for wireless networks? (Choose TWO.)
⚠ Common exam trap
Many candidates confuse WPA2-PSK with WPA2-Enterprise, assuming both provide strong authentication, but the exam tests the distinction that PSK lacks per-user authentication and is vulnerable to dictionary attacks, while Enterprise uses RADIUS for robust identity verification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
WPA2-Enterprise
WPA2-Enterprise (C) is correct because it uses IEEE 802.1X authentication with a RADIUS server, providing mutual authentication and per-session dynamic encryption keys via the 4-way handshake using AES-CCMP. WPA3 (E) is correct because it introduces Simultaneous Authentication of Equals (SAE) to replace the pre-shared key (PSK) handshake, offering forward secrecy and stronger encryption with GCMP-256, and also supports 802.1X for enterprise deployments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
WEP
Why it's wrong here
WEP (Wired Equivalent Privacy) is fundamentally flawed and considered highly insecure for both encryption and authentication. It utilizes the RC4 stream cipher with a static or easily guessable Initialization Vector (IV), making it vulnerable to replay attacks and statistical analysis that can quickly reveal the encryption key. Its authentication mechanism, often a simple shared secret or open system, provides no real protection against unauthorized access.
- ✗
WPA2-PSK
Why it's wrong here
WPA2-PSK (Pre-Shared Key), while employing strong AES-CCMP encryption, relies on a single passphrase for authenticating all users to the network. This method is susceptible to offline dictionary attacks if the passphrase is weak, and its compromise grants full network access without individual user accountability. It lacks the robust, per-user authentication and dynamic key management capabilities essential for enterprise-level security.
- ✓
WPA2-Enterprise
Why this is correct
WPA2-Enterprise provides robust encryption and authentication by integrating the 802.1X framework with an external authentication server, typically RADIUS. This architecture supports strong, centralized user or device authentication using methods like EAP-TLS with certificates, EAP-PEAP, or EAP-TTLS, dynamically generating unique encryption keys for each client session. This ensures strong, individualized security, accountability, and protection against unauthorized access.
- ✗
MAC filtering
Why it's wrong here
MAC filtering is an extremely weak security measure that attempts to restrict network access based on a device's hardware MAC address. It offers no encryption whatsoever and provides negligible authentication, as MAC addresses are broadcast in the clear and can be easily spoofed by an attacker with readily available tools. Relying on MAC filtering leaves a network completely exposed to unauthorized access and data interception.
- ✓
WPA3
Why this is correct
WPA3 significantly enhances Wi-Fi security beyond WPA2 by introducing Simultaneous Authentication of Equals (SAE) for stronger password-based authentication, which effectively prevents offline dictionary attacks. It mandates 128-bit AES encryption in WPA3-Personal and 192-bit CNSA-grade encryption in WPA3-Enterprise, ensuring robust data confidentiality. Furthermore, WPA3 provides Opportunistic Wireless Encryption (OWE) for open networks, encrypting traffic even without explicit authentication.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Security Operations Foundations
Key term
RADIUS
RADIUS is a network protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.