Spectrum analyzer observations indicate a narrow 1–2 MHz peak with a strong signal, which broadens only when significantly attenuated. This behavior matches a high-powered narrowband interferer (like a microwave ignitor or industrial radio) – not Bluetooth hopping or standard WLAN signals

EAP-FAST (Flexible Authentication via Secure Tunneling) provides:

Mutual authentication using Protected Access Credentials (PACs).

Does not require X.509 certificates for either client or server (although optional for servers).

Is faster and easier to deploy in environments lacking a PKI.

Incorrect:

B. EAP-MD5 provides no mutual authentication.

C. EAP-TLS requires client and server certificates.

D. PEAPv0/EAP-MSCHAPv2 requires a server certificate.

E. EAP-TTLS requires a server certificate.

F. PEAPv1/EAP-GTC still requires a server certificate.

Because all APs (even those at branch offices) connect to a central controller:

Their control/data traffic must traverse the public internet or WAN.

VPNs (IPSec, GRE, or similar) ensure confidentiality and integrity of authentication traffic and user data over insecure links.

Incorrect:

B. Using different SSIDs complicates management and user experience unnecessarily.

C. Remote RADIUS at small branches contradicts the goal of centralized management.

D. Remote access protocols (SSH, HTTPS) should be secured, not entirely prohibited, to allow remote management.

Role-Based Access Control (RBAC) allows administrators to define user roles and enforce network access permissions based on the user’s identity. By implementing RBAC in the WLAN, you can:

Grant the Marketing group access only to the file/email server and the Internet

Prevent access to other internal resources

This single feature enables fine-grained restriction without needing multiple SSIDs or ACLs.

Other options don’t provide the necessary flexibility:

A. Mutual authentication ensures secure identity verification but doesn't control network access scope

B & D & E do not provide targeted resource-level access control

Outdoor APs must be:

Protected from theft or tampering (physical security).

Shielded from weather/environmental conditions (IP-rated enclosures).

Mounted and secured to prevent unauthorized physical access or damage.

Incorrect:

A & B. Antenna type is relevant to RF coverage but does not address outdoor-specific security needs.

C. PoE is useful for power delivery but not a security solution.

The GTK (Group Temporal Key) is used to encrypt multicast/broadcast traffic.

Each SSID has a unique GTK.

Only clients on the same SSID (ABCData) will receive and be able to decrypt multicast traffic encrypted with ABCData’s GTK.

Incorrect:

A. Application-layer authentication does not affect GTK distribution.

C. Clients on other SSIDs (e.g., Guest, ABCVoice) have different GTKs and cannot decrypt ABCData’s multicast traffic.

D. Each SSID uses a unique GTK; GTKs are not shared across SSIDs.

A Robust Security Network (RSN) is defined by the IEEE 802.11i standard and is designed to provide a framework for secure wireless LAN communications. One of the primary criteria for a network to qualify as an RSN is that WEP (Wired Equivalent Privacy) must not be used for encryption, as WEP has well-known vulnerabilities and is considered insecure. RSN-compliant networks must use either CCMP (AES) or GCMP for encryption and 802.1X/EAP or WPA2-Personal for authentication.

Incorrect:

A. Token cards are not part of RSN criteria.

B. Dynamic WEP is still WEP and disqualifies RSN status.

D. WPA-Personal may be supported, but alone does not define an RSN.

E. SSHv1 concerns device management security, not RSN qualification.