ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

WPA3-Personal is designed for environments that want to keep a preshared key approach but need stronger protection. It replaces the WPA2 4-way handshake with the Simultaneous Authentication of Equals (SAE) key exchange, which provides forward secrecy and prevents an attacker who records the handshake from running offline dictionary or brute-force attacks. WPA2-Enterprise (with PEAP) would also stop offline attacks, but it requires deploying and maintaining a RADIUS server, which management explicitly wants to avoid. Enabling 802.11r or simply continuing with WPA2-AES does nothing to mitigate the handshake weakness. Downgrading to WEP with MAC filtering dramatically reduces security and leaves the network vulnerable to numerous well-known attacks. Therefore, upgrading the WLAN to WPA3-Personal with SAE best meets the stated requirements.