A secure WLAN must control who joins and protect traffic over the radio
Wireless transmissions leave the cable and travel through shared airspace. Security therefore needs authentication to control network access and encryption/integrity to protect frames from passive observation and tampering. WPA2 and WPA3 are the primary modern Wi-Fi security families; obsolete WEP should not be used.
Wireless admission is the start of a controlled access path. The AP Networking Secure Access, Authentication, and Authorization Practice Test tests what follows: managed-device conditions, effective VLAN assignment, application roles, certificate identity, and the restrictions that must remain after a legitimate client is restored.
Wireless security does not end at association. Connected guests or IoT devices still need appropriate VLAN and firewall policy.
WPA2 remains widely deployed but should use strong modes and credentials
WPA2-Personal uses a pre-shared key/passphrase; everyone sharing that credential can join. WPA2-Enterprise uses 802.1X/EAP with individual user/device authentication through infrastructure such as RADIUS. Enterprise mode scales identity and revocation better in managed organizations.
Weak shared passphrases remain a vulnerability even when the encryption protocol itself is appropriate.
WPA3 improves important aspects of modern Wi-Fi security
WPA3-Personal uses SAE (Simultaneous Authentication of Equals) rather than the WPA2-Personal PSK handshake design, improving resistance to offline password-guessing attacks. WPA3 also requires Protected Management Frames in its certification profile. Device compatibility can affect migration.
Use WPA2 vs. WPA3 for the direct comparison.
An open SSID does not provide equivalent link-layer confidentiality
Users should not assume a coffee-shop or guest SSID is private because a web login page appears. HTTPS can still protect individual application sessions, but the WLAN itself lacks WPA2/WPA3 access encryption if truly open. Enhanced Open/OWE is a separate technology and should not be conflated with ordinary open Wi-Fi.
Guest access should be separated from trusted internal resources
A guest WLAN can map to a guest VLAN with policy allowing Internet/DNS/DHCP while denying access to staff, management, and server subnets. Client isolation can also reduce guest-to-guest communication. The security requirement determines the exact rules.
Naming an SSID 'Guest' has no security effect without actual segmentation and policy.
Unauthorized APs can create alternate wireless paths
A rogue AP is an unauthorized device connected to the network. An evil-twin attack imitates a legitimate SSID to lure clients. Certificate-based enterprise authentication, wireless monitoring, user awareness, and controlled infrastructure help reduce these risks. Strong signal alone is not proof an AP is trustworthy.
Secure the AP itself
Change default administrator credentials, patch firmware, restrict management interfaces to trusted networks, use encrypted administration, and disable unnecessary remote management. A well-encrypted SSID does not protect a web admin interface exposed to every guest.
Least privilege applies to infrastructure management too.
Security failure happens before DHCP
If the client never authenticates to WPA2/WPA3, do not troubleshoot the DHCP server first. If authentication succeeds and the client then receives no lease, move to VLAN/DHCP. Separating these stages prevents security and addressing problems from being mixed together.