Two axes on one map
Wi-Fi Protected Access questions mix two separate choices, and most confusion comes from collapsing them into one. The first axis is the generation, WPA2 or WPA3. The second is the authentication mode, Personal or Enterprise. Encryption strength mostly follows the generation; who holds a credential follows the mode. The same habit of keeping two rankings apart pays off later in routing, where administrative distance and metric are separate contests.
In v1.1 the topic is split between 5.9 (WPA, WPA2 and WPA3 compared) and 5.10 (a WPA2-PSK WLAN built in a controller GUI); v2.0 folds wireless security protocols into topic 1.5. Channels, AP modes and controller architecture are in the wireless LANs study area. v1.1 5.9 still names WPA beside WPA2 and WPA3: know that it ran TKIP and is legacy, which makes it the usual wrong option in practice sets.
Four combinations, side by side
| Point of comparison | WPA2-Personal | WPA2-Enterprise | WPA3-Personal | WPA3-Enterprise |
|---|---|---|---|---|
| Authentication | PSK | 802.1X with EAP | SAE | 802.1X with EAP |
| Credential | One passphrase for every client | Per user or per device | One password for every client | Per user or per device |
| Who checks it | The AP or WLC | An authentication server, usually RADIUS | The AP or WLC | An authentication server, usually RADIUS |
| Encryption | AES-CCMP | AES-CCMP | AES-CCMP | AES, with an optional 192-bit security mode |
| Protected management frames | Optional | Optional | Required | Required |
| Offline guessing from a capture | Possible against a weak passphrase | No shared passphrase to guess | Resisted by SAE | No shared passphrase to guess |
Sources: the Wi-Fi Alliance security overview (listed below) and IEEE 802.11-2020.
What WPA3 changes underneath
SAE in place of the pre-shared key
In WPA2-Personal the passphrase feeds the key material directly, so anyone who records a client joining has what they need to test passphrases at leisure afterwards. WPA3-Personal runs Simultaneous Authentication of Equals (SAE) first. The keys that the four-way handshake then confirms come out of that exchange, and a recording of it gives an attacker nothing to test guesses against offline.
Protected management frames become mandatory
Management frames such as deauthentication and disassociation travel unprotected in older deployments, which lets a nearby device forge them and knock clients off. Protected Management Frames (PMF) sign them. WPA2 allows PMF; the Wi-Fi Alliance requires it for every WPA3 network.
Enterprise mode keeps 802.1X and adds a stronger option
WPA3-Enterprise authenticates exactly as WPA2-Enterprise does, through 802.1X and an EAP method checked by a server. The addition is a 192-bit security mode for networks that need a fixed, higher cipher suite. The server side is usually RADIUS; the TACACS+ vs RADIUS page covers its ports and why it suits network access.
Frames on WPA2 vs WPA3
Decide which axis a frame is asking about, generation or mode, before you weigh the options; several distractors are true statements about the other axis.
Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.
Frame 001 of 006 · 0 answered · 0 ok
Keys
1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list
- Frame 001 of 006
Which of the following wireless security protocols is considered the most secure?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: WPA3 replaces the pre-shared key handshake with SAE and makes management frame protection mandatory, so it is the strongest here.
Note on B
WPA2 with AES-CCMP is still widely used, but its PSK handshake can be captured and attacked offline, which WPA3 fixes.
Note on C
WPA was an interim fix built around TKIP and is now considered legacy.
Note on D
WEP uses RC4 with short, reused initialization vectors and can be cracked in minutes.
Best answer: A · why
From weakest to strongest: WEP (RC4, broken), WPA (TKIP, an interim fix), WPA2 (AES-CCMP) and WPA3. WPA3-Personal uses Simultaneous Authentication of Equals (SAE) instead of a PSK handshake, which resists offline dictionary attacks. WPA3 also requires Protected Management Frames, and WPA3-Enterprise adds a 192-bit mode.
- Frame 002 of 006Choose 2
Which two authentication methods are commonly used in WPA3 for wireless networks? (Choose two.)
Choose 2 options, then Check answer. Open the note under any option to see why.
Note on A
WEP shared-key authentication is the broken method from the original 802.11 standard. WPA3 does not allow WEP at all.
Note on B
Correct. WPA3-Enterprise authenticates each user or device with 802.1X and an EAP method through a RADIUS server.
Note on C
LEAP is an old Cisco EAP method with known weaknesses to offline dictionary attacks. WPA3 does not rely on it.
Note on D
Correct. WPA3-Personal replaces the WPA2 pre-shared key handshake with SAE, Simultaneous Authentication of Equals.
Best answers: B and D · why
WPA3 keeps the personal and enterprise split of WPA2. WPA3-Personal authenticates with SAE (Simultaneous Authentication of Equals), a password-based exchange that resists offline dictionary attacks and gives forward secrecy. WPA3-Enterprise authenticates each user or device with 802.1X, an EAP method and a RADIUS server, and adds an optional 192-bit mode. Both require Protected Management Frames.
- Frame 003 of 006
Which wireless encryption method uses CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) as its encryption algorithm?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
An open network uses no encryption at all, so there is no cipher such as CCMP.
Note on B
WPA was built around TKIP so that WEP-era hardware could run it; CCMP became mandatory only with WPA2.
Note on C
Correct: WPA2 requires AES-based CCMP, the encryption the 802.11i standard defined.
Note on D
WEP relies on the RC4 stream cipher, which predates CCMP and is no longer considered secure.
Best answer: C · why
CCMP is the AES-based encryption protocol from IEEE 802.11i, and WPA2 makes it mandatory. WPA used TKIP, built on RC4, so older hardware could be upgraded. WEP used RC4 with weak initialization vectors. An open network has no encryption. WPA3 also uses AES-based encryption, but it is not one of the choices here.
- Frame 004 of 006
What is the primary difference between WPA2-Personal and WPA2-Enterprise?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
The number of clients depends on the access point and network design, not on whether PSK or 802.1X is used.
Note on B
This reverses the roles: Personal is the home and small-office mode, and Enterprise is built for organizations with a RADIUS server.
Note on C
Correct: Enterprise authenticates each user or device with 802.1X against a RADIUS server, while Personal uses one passphrase shared by everyone.
Note on D
Both modes use the same AES-CCMP encryption; they differ in how users are authenticated and keys are derived.
Best answer: C · why
WPA2 has two authentication modes with the same AES-CCMP encryption. WPA2-Personal uses a pre-shared key that every client knows, which is simple but means one shared secret for the whole network. WPA2-Enterprise uses 802.1X: each user or device authenticates with its own credentials through a RADIUS server, and each session gets unique keys.
- Frame 005 of 006
Which statement best describes how the Simultaneous Authentication of Equals (SAE) mechanism in WPA3 defends against offline dictionary attacks?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
SAE is a password-based exchange; certificates belong to 802.1X methods such as EAP-TLS in Enterprise mode.
Note on B
Correct: SAE derives keys through a Diffie-Hellman-style commit and confirm exchange, so a captured handshake gives an attacker nothing to test offline.
Note on C
SAE does the opposite: it replaces the static PSK-based handshake with a fresh key exchange for every session.
Note on D
Longer passphrases help any PSK network, but SAE’s protection comes from the exchange itself, not from passphrase length.
Best answer: B · why
With WPA2-Personal, an attacker can capture the four-way handshake and try passwords offline at full speed. WPA3-Personal uses Simultaneous Authentication of Equals (SAE), a password-authenticated key exchange based on Diffie-Hellman. Each side commits to a value and then confirms it, and a fresh key is derived for every session. The captured exchange reveals nothing that can be checked offline, so each guess needs a new live attempt against the network. SAE also provides forward secrecy.
- Frame 006 of 006
What is the primary vulnerability associated with using a shared pre-shared key (PSK) for wireless network security in a corporate environment?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: everyone shares the same key, so one stolen laptop or departing employee exposes it, and changing it means touching every device.
Note on B
A shared PSK keeps out only people who do not know it; anyone who learns it can connect, so it does not stop every unauthorized device.
Note on C
A PSK has nothing to do with protocol upgrades; the encryption is whatever the WLAN is configured to use.
Note on D
Per-user authentication is what 802.1X provides; a PSK identifies nobody, because all users present the same secret.
Best answer: A · why
With a pre-shared key, every user and device knows the same secret. If one client is compromised or one person leaves, the key is effectively public, and rotating it means reconfiguring every device. A PSK also cannot tell users apart, so there is no per-user accounting or revocation. Corporate WLANs therefore use WPA2- or WPA3-Enterprise with 802.1X and RADIUS.
Wi-Fi security, quick answers
Is WPA3 slower than WPA2?
The security mode decides how clients authenticate and how frames are encrypted. Data rates come from the 802.11 amendment in use and the radio conditions (IEEE 802.11-2020), so a WPA3 network is not slower by design.
Do WPA3-Enterprise users need different credentials from WPA2-Enterprise?
No. Both run 802.1X with an EAP method checked by an authentication server, so the per-user or per-device credentials carry over. The changes sit in the cipher options and the PMF requirement.
Who is the WPA3 192-bit mode for?
Enterprise networks that carry highly sensitive data and want a fixed, stronger cipher suite. It is an Enterprise option only; WPA3-Personal has no 192-bit mode (Wi-Fi Alliance security overview).
References
- [1]Wi-Fi Alliance: Wi-Fi security (WPA3, Protected Management Frames)Checked October 29, 2026.
- [2]RFC 2865: Remote Authentication Dial In User Service (RADIUS)
- [3]Cisco Learning Network: CCNA v1.1 exam topicsChecked October 29, 2026.
- [4]Cisco Learning Network: CCNA v2.0 exam topicsChecked October 29, 2026.