In EAP-TLS, mutual authentication is critical. If the client does not validate the RADIUS server’s certificate, it cannot confirm it is connecting to a legitimate server. This allows an attacker to set up a rogue access point and RADIUS server, impersonate the legitimate network, and complete the TLS handshake with the client, potentially capturing credentials or manipulating the session. The other options describe risks associated with different flaws: downgrade attacks relate to protocol negotiation, passive eavesdropping is mitigated by WPA3’s encryption, and weak keys are not a direct result of missing server certificate validation in TLS.

Layer 1 DoS attacks, such as a continuous transmitter or a targeted RF jammer, disrupt the physical medium itself. A spectrum analyzer is the primary tool for observing the RF spectrum directly. It can identify non-Wi-Fi interference (e.g., microwaves, Bluetooth) or malicious signals (e.g., constant carrier waves) that would cause the described symptoms. The other options are useful for other issues: authentication logs point to credential/802.1X problems, rogue APs indicate spoofing attacks, and poor RSSI/SNR could simply indicate weak signal or co-channel interference, not definitive proof of an intentional DoS.

This solution directly addresses the core requirement. A separate SSID and VLAN provide logical network segmentation. Client isolation, a feature at the AP or WLC, prevents wireless clients on the same SSID/VLAN from communicating directly with each other at Layer 2, forcing all traffic through the gateway (which can then apply further firewall rules). WPA2-PSK provides adequate authentication/encryption for simple IoT devices. WPA3-Enterprise is overkill for sensors and doesn’t inherently provide client isolation. An open SSID with a portal lacks encryption. MAC filtering is easily spoofed and does not provide isolation.

Management Frame Protection (MFP), standardized as 802.11w, is designed to protect unicast and multicast management frames (specifically Deauthentication, Disassociation, and some Action frames) from forgery and spoofing. This directly mitigates attacks where a malicious actor sends spoofed deauthentication frames to disconnect clients from the network. It does not prevent Evil Twin (rogue AP) setups, KRACK (which targets the 4-way handshake), or EAP downgrade attacks within the 802.1X framework.

Using 802.1X with dynamic policy assignment from the RADIUS server is the most secure and scalable method. Corporate devices can authenticate with machine certificates, while BYOD devices authenticate with user credentials. The RADIUS server (e.g., NPS, ClearPass) can then send specific attributes like `Tunnel-Private-Group-ID` (for VLAN assignment) or `Filter-Id` (for ACL application) based on the authentication method or user/group membership. This centralizes policy control, avoids the management nightmare of multiple SSIDs or MAC address lists, and is more reliable than OS profiling.

The core security improvement of SAE (Dragonfly handshake) over PSK is its resistance to offline dictionary attacks. In WPA2-PSK, an attacker can capture the 4-way handshake and attempt to guess the PSK offline. SAE uses a commit-confirm exchange based on a zero-knowledge proof, where neither party reveals enough information for an eavesdropper to perform an offline attack on the password. The handshake is active, requiring participation, making passive capture useless for password cracking. Option D describes forward secrecy, a benefit, but not the primary mechanism defeating offline attacks. GCMP-256 is for encryption, not the handshake. Certificates are not part of SAE.

A soft-AP (or hotspot) feature on a laptop causes it to operate in a dual role: as a client (station) to the legitimate corporate network and as an access point for other devices. A sophisticated WIDS can detect this by correlating MAC addresses—seeing the same MAC address first appearing as a source in data frames (as a client) and then as a source in beacon frames (as an AP). This is a strong indicator of an unauthorized AP. Option D describes a rogue AP with SSID spoofing, which could be a separate physical device. Option A is a DoS attack. Option C indicates credential issues.

EAP-TTLS establishes a secure TLS tunnel first, protecting the subsequent inner authentication exchange. However, if the inner method is MSCHAPv2, the MSCHAPv2 challenge-response hashes are transmitted *inside* this encrypted tunnel. If an attacker can somehow compromise the TLS tunnel (e.g., via a compromised certificate or implementation flaw) or if the hashes are captured from the client or server memory, these hashes are vulnerable to efficient offline dictionary or brute-force attacks to recover the plaintext password. The audit finding likely points to the weakness of MSCHAPv2 itself. The outer TLS tunnel is not cleartext (A), mutual authentication is provided by TLS (C), and RC4 is not mandated (D).

Wi-Fi CERTIFIED WPA3™ with the Wi-Fi CERTIFIED IoT™ designation includes specific features for IoT devices. A key component for low-power devices is WPA3-Personal with Simultaneous Authentication of Equals (SAE) using Dragonfly, which provides robust security. More importantly, the IoT certification often includes support for Wi-Fi Enhanced Open (for public devices) and, critically, features like Target Wake Time (TWT) for power management and improved operational efficiency in dense environments—vital for battery-powered medical sensors. While standard WPA3 is secure, the IoT-specific certification ensures the implementation is optimized for the unique constraints of such devices.

In EAP-TLS, mutual authentication is critical. If the client does not validate the RADIUS server’s certificate, it cannot confirm it is connecting to a legitimate server. This allows an attacker to set up a rogue access point and RADIUS server, impersonate the legitimate network, and complete the TLS handshake with the client, potentially capturing credentials or manipulating the session. The other options describe risks associated with different flaws: downgrade attacks relate to protocol negotiation, passive eavesdropping is mitigated by WPA3’s encryption, and weak keys are not a direct result of missing server certificate validation in TLS.0