Exam 200-301 topic 1 question 269 discussion

Ok, I'm going to take a swing a this... So, the question specifically states compatible devices "Users need to connect to the wireless network with IEEE 802.11r-COMPATIBLE DEVICES." According to the reference link, it states "If clients do not support mixed mode or 802.11r join, they can join non-802.11r WLANs. When you configure FT PSK and later define PSK, clients that can join only PSK can now join the WLAN in mixed mode." Therefore, if you want to configure Fast Transition with COMPATIBLE DEVICES, select the FT 802.1X option. If they are non-compatible they can still join by utilizing the Pre-shared key (if selected). Consequently, I believe B is correct.

This question is strictly based on the configuration that is displayed here. You cannot use FT 802.1x because you don't have it configured on the the WLC; as PSK is checked not 802.1x. For you to not have to reconfigure the security setting of your network the quickest way to achieve roaming is via PSK as PSK is already configured.

I think correct answer is B. Why to use PSK if 802.1X is available ? We dont use PSK typically for internal users.

C is correct

802.11r BSS Fast Transition Deployment Guide - Cisco "... Configuring 802.11r Fast Transition (GUI) Procedure ... Step 8 Under Authentication Key Management, choose FT 802.1X or FT PSK. Check or uncheck the corresponding check boxes to enable or disable the keys. If you check the FT PSK check box, from the PSK Format drop-down list, choose ASCII or Hex and enter the key value. Note When Fast Transition adaptive is enabled, you can use only 802.1X and PSK AKM. ..."

There are two options for enabling Fast Transition: FT 802.1x: This option is used when the wireless network employs 802.1x/EAP (Extensible Authentication Protocol) for client authentication. It allows clients to quickly transition between access points within the same ESS without reauthenticating with the RADIUS server. The clients continue using their existing 802.1x credentials as they roam. FT PSK (Pre-Shared Key): This option is used when the wireless network uses WPA2-Personal (PSK) for client authentication. It enables fast roaming for clients that use a pre-shared key passphrase for authentication. FT PSK allows clients to roam seamlessly without reentering the PSK passphrase as they move between access points within the same ESS. Because PSK has been checked already. so C is correct.

If the goal is to maintain a seamless connection for users with IEEE 802.11r-compatible devices as they move between floors or areas in a building, it is recommended to use the FT 802.1x option instead of the PSK (Pre-Shared Key) option. The FT 802.1x option provides enhanced security and seamless authentication during the handoff process. It utilizes the IEEE 802.1x/EAP authentication method, which involves individual authentication for each user. This ensures that users are securely authenticated and their communication remains confidential. On the other hand, the PSK option relies on a pre-shared key that is shared among all devices connecting to the network. While it provides a simpler configuration process, it may not offer the same level of security and flexibility as the FT 802.1x option. By selecting the FT 802.1x option, you can benefit from the advanced security features and seamless authentication provided by IEEE 802.11r. This is especially important in environments where maintaining a high level of security and uninterrupted connectivity is a priority.

https://www.cisco.com/c/dam/en/us/td/docs/wireless/controller/technotes/80211r-ft/b-80211r-dg.html In here say When Fast Transition adaptive is enabled, you can use only 802.1X and PSK AKM.. So answer is B

you cannt use FT mode without 802.1x

When Fast Transition adaptive is enabled, you can use only 802.1X

PSK is enabled as a authenticatiion method, So i guess the right answer is C, because you just need to enable fast transition and FT PSK; https://www.wiresandwi.fi/blog/configuring-fast-transition-ft-80211r-on-a-cisco-wlc

B : is correct

I really dont understand why it is b, doesnt make c more sense because we want PSK?