Wireless security protocols matching lab

Match WPA3-Personal, Enterprise+RADIUS, AES-only, and Kerberos SSO; leave WEP/open and TKIP-for-speed unused.

Match each wireless-security ticket to the right control. Leave WEP/open and TKIP-for-speed unused.

CompTIA 2.3 wants WPA2/WPA3 with AES, personal vs enterprise (RADIUS), and clear separation from Kerberos SSO and dead ciphers like TKIP/WEP.

Guest SSID still on WPA2-PSK; offline crack risk

Personal mode, modern phones. Upgrade the handshake without standing up RADIUS yet.

Corp SSID must use per-user AD credentials

No shared passphrase. AP should 802.1X to AAA. Shared PSK is the wrong class.

Audit finding: mixed WPA2 TKIP+AES still enabled

Legacy printers tempted mixed mode. Cipher policy is the fix — not a new SSID name.

Users want SSO to file shares after domain join

Wi-Fi is already Enterprise. This ticket is about domain authentication tickets, not the AP PSK field.

Still on the bench

WPA3-Personal (SAE) — replace WPA2-PSK on the guest SSID — SAE resists offline PSK dictionary attacks better than WPA2-PSK. Prefer WPA3 when clients support it.
WPA2/WPA3-Enterprise + 802.1X talking to RADIUS — Corp SSIDs use per-user credentials via RADIUS — not one shared lobby passphrase.
AES-CCMP only — disable TKIP / mixed mode — TKIP is a finding. Force AES (CCMP); drop legacy mixed modes that re-enable weak ciphers.
Kerberos for domain SSO (not a Wi-Fi PSK) — Kerberos tickets domain logons. It is not the shared key on a SOHO AP — do not confuse with WPA-PSK.
Leave WEP or open auth 'for compatibility' — WEP/open is on-path candy. Compatibility excuses do not make them acceptable on exam or in production.
Re-enable TKIP because a sticky client is slow on AES — Speed complaints do not justify TKIP. Fix the client or SSID plan — keep AES.