Certified Ethical Hacker (CEH) Practice Question

Using WPA2-Enterprise (or WPA3-Enterprise) with a certificate-based EAP method such as EAP-TLS forces every client to verify the RADIUS server's certificate during authentication. If the presented certificate is not signed by the trusted internal CA, authentication fails and the client will not associate, even if the SSID and encryption settings appear identical. Hiding the SSID only deters casual scanning and does not stop an attacker from broadcasting the same name. MAC address filtering protects the infrastructure, not the client, and addresses are easily spoofed. Changing to 802.11n Greenfield mode affects modulation support, not authentication, so it offers no protection against evil-twin impersonation.