How to Configure WPA2+WPA3 Personal Security Encryption?

A wireless network engineer must configure a WPA2+WPA3 policy with the Personal security type. Which action meets this requirement?

Configure the CCMP256 encryption cipher.
Configure the CCMP128 encryption cipher. Source Reference Answer
Configure the GCMP256 encryption cipher.
Configure the GCMP128 encryption cipher.

Community Votes

100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question traps candidates who associate WPA3 exclusively with newer ciphers like GCMP256, overlooking that transition modes require fallback to WPA2-compatible CCMP128.

This question tests knowledge of encryption cipher compatibility when deploying a WPA2/WPA3 Personal transition mode on Cisco wireless controllers. The community strongly agrees that CCMP128 is the only supported cipher for this specific configuration due to backward compatibility requirements.

Many candidates incorrectly select GCMP256, assuming it is the standard for WPA3. However, GCMP256 is not supported in WPA2+WPA3-Personal mixed/transition mode because older WPA2 clients cannot negotiate it, forcing the system to fall back to CCMP128.

Community Discussion (10 comments)

IgorLVG 👍 7 Selected: B

Chose the Encryption Cipher from the following options: CCMP128(AES) CCMP256 (not available for Personal security type) GCMP128 (not available for Personal security type) GCMP256 (not available for Personal security type)

CiscoTerminator 👍 5

CCMP to CCNP, I smell a rat.

AbdullahMohammad251 👍 4 Selected: B

WPA2 supports only 128-bit encryption keys, while WPA3 supports 128, 192, and 256-bit keys. WPA3-Personal permits the use of CCMP-128 as the minimum encryption algorithm. WPA2 does not support CCMP-256 or the GCMP protocol. However, CCMP-128 is supported by both WPA2 and WPA3. https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#:~:text=The%20new%20standard%20uses%20an%20equivalent%20192%2Dbit%20cryptographic%20strength%20in%20WPA3%2DEnterprise%20mode%5B20%5D%20(AES%2D256%20in%20GCM%20mode%20with%20SHA%2D384%20as%20HMAC)%2C%20and%20still%20mandates%20the%20use%20of%20CCMP%2D128%20(AES%2D128%20in%20CCM%20mode)%20as%20the%20minimum%20encryption%20algorithm%20in%20WPA3%2DPersonal%20mode.%20TKIP%20is%20not%20allowed%20in%20WPA3.

yasmiine 👍 2 Selected: B

Answer B

Adalberto 👍 1 Selected: C

Answear is C

RickAO76 👍 4 Selected: B

Back to B, sorry Cisco docs > open source

dc583a7 👍 2

Answer is B WPA2+WPA3-Personal Transition Mode with 6 GHz https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/wpa3-dg.html

lohitnadimpalli 👍 1

Answer is C https://www.techtarget.com/searchsecurity/definition/WPA3 WPA3 security uses GCMP-256 encryption instead of 128-bit encryption. Additional info: CCMP256 is a cipher used only for WPA3 Enterprise security, not for WPA3 Personal. CCMP128 is the encryption cipher used for WPA2, not for WPA3.

babanaber 👍 4 Selected: B

The answer is correct https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/config-guide/b_cg810/wlan_security.html#:~:text=Save%20the%20configuration.-,Configuring%20SAE%20Mixed%20Mode%20(WPA2%2BWPA3)%20(GUI),CCMP128(AES),-CCMP256%20(not%20available

RickAO76 👍 1 Selected: C

I feel like this one is C, can not confirm

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Core Concept: Transition Mode Compatibility

WPA3 introduces stronger encryption protocols like GCMP-256 and supports CCMP-256 for enterprise environments. However, when configuring a WPA2+WPA3-Personal transition mode (also known as mixed mode), the access point must support legacy WPA2 clients. WPA2 strictly mandates AES-CCMP with 128-bit keys. Consequently, Cisco wireless controllers restrict the available encryption cipher for this hybrid policy to CCMP128 only.

Why CCMP128 is Correct

In a mixed-mode deployment, the authentication mechanism uses SAE (Simultaneous Authentication of Equals) for WPA3 clients while maintaining PSK compatibility for WPA2 devices. Because WPA2 clients cannot interpret GCMP or 256-bit CCMP suites, the controller automatically defaults to CCMP128 to ensure seamless association across all connected devices. This aligns with Cisco's explicit configuration guidelines for Personal transition policies.

Why Other Options Fail

Options A, C, and D are invalid for this scenario. CCMP256 is reserved exclusively for WPA3-Enterprise configurations. GCMP128 and GCMP256 utilize Galois/Counter Mode, which lacks backward compatibility with WPA2 infrastructure. As highlighted by community contributors, attempting to force these ciphers in a Personal transition mode will result in configuration rejection or client dropouts.

Community & Documentation Validation

Multiple verified candidates and Cisco design documents confirm that CCMP128 is the mandatory selection. Cisco's official technical references explicitly state that CCMP256 and GCMP variants are unavailable for Personal security types, cementing CCMP128 as the definitive answer.

Official Reference

Exam Strategy

When encountering WPA3 configuration questions, always check if the deployment specifies a transition or mixed mode. If backward compatibility with WPA2 is required, prioritize AES-CCMP 128-bit over newer ciphers like GCMP-256, as legacy client negotiation dictates the cipher selection regardless of WPA3's advanced capabilities.

Related Analysis

Practice All 350-401 Questions

Access 218 questions with complete answers and detailed explanations.

View Full 350-401 Practice Test →

← Back to 350-401 Study Guide