CISSP Communication and Network Security Practice Question
Which wireless security protocol replaces the pre-shared key (PSK) authentication with Simultaneous Authentication of Equals (SAE) to provide stronger security and forward secrecy?
⚠ Common exam trap
Candidates often confuse encryption strength with authentication improvements. While WPA2 with CCMP uses AES encryption, this question focuses on authentication (PSK vs SAE), not encryption. The key difference is that SAE provides forward secrecy and resistance to offline dictionary attacks, which are unique to WPA3.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
WPA3
WPA3 replaces the Pre-Shared Key (PSK) authentication used in WPA2 with Simultaneous Authentication of Equals (SAE), defined in IEEE 802.11-2016 and specified in RFC 7664. SAE provides forward secrecy by using a Diffie-Hellman key exchange that ensures even if the long-term password is compromised, past session keys remain secure. This eliminates vulnerabilities to offline dictionary attacks that plague WPA2-PSK.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
WPA3
Why this is correct
WPA3 significantly enhances wireless security by replacing the vulnerable Pre-Shared Key (PSK) 4-way handshake with the Simultaneous Authentication of Equals (SAE) protocol, also known as Dragonfly. SAE is a password-authenticated key agreement (PAKE) protocol that establishes a secure session key without ever transmitting the password directly. This robust cryptographic exchange provides stronger protection against offline dictionary attacks and ensures forward secrecy, making it the correct answer for replacing the PSK mechanism.
- ✗
WEP
Why it's wrong here
WEP (Wired Equivalent Privacy) does not replace the pre-shared key; instead, it fundamentally relies on a static, shared secret key for both authentication and encryption. Its design flaws, including the use of a weak RC4 stream cipher with a short initialization vector (IV) that is often reused, make it highly susceptible to various attacks, such as IV collision attacks and key recovery. WEP offers no forward secrecy and is considered completely insecure, making it an unsuitable and deprecated protocol for modern wireless security.
- ✗
WPA2 with TKIP
Why it's wrong here
WPA2 with TKIP (Temporal Key Integrity Protocol) does not replace the pre-shared key; rather, it was introduced as an interim solution to provide some WEP-like compatibility and improve upon WEP's weaknesses without requiring new hardware. While WPA2 itself can use PSK or 802.1X for key management, TKIP is known to have vulnerabilities and is largely deprecated. It still relies on the underlying WPA2 key exchange, which, in the case of WPA2-Personal, is a PSK-based 4-way handshake, not a replacement for it.
- ✗
WPA2 with CCMP
Why it's wrong here
WPA2 with CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) is the robust and preferred security protocol for WPA2, providing strong encryption and integrity using AES. However, it does not replace the pre-shared key mechanism but rather uses it as one of its primary key establishment methods in WPA2-Personal mode. The 4-way handshake in WPA2-Personal, whether using CCMP or TKIP, derives session keys from a pre-shared key, making it susceptible to offline dictionary attacks if the PSK is weak.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.