How to Configure WPA2+WPA3 Personal Security Encryption?

350-401 By islever Editorial Last updated

Short answer

B Configure the CCMP128 encryption cipher.

Question

A wireless network engineer must configure a WPA2+WPA3 policy with the Personal security type. Which action meets this requirement?
  1. Configure the CCMP256 encryption cipher.
  2. Configure the CCMP128 encryption cipher. Correct Answer
  3. Configure the GCMP256 encryption cipher.
  4. Configure the GCMP128 encryption cipher.

Key Takeaways

The question traps candidates who associate WPA3 exclusively with newer ciphers like GCMP256, overlooking that transition modes require fallback to WPA2-compatible CCMP128.

This question tests knowledge of encryption cipher compatibility when deploying a WPA2/WPA3 Personal transition mode on Cisco wireless controllers. The community strongly agrees that CCMP128 is the only supported cipher for this specific configuration due to backward compatibility requirements.

Common mistake: Many candidates incorrectly select GCMP256, assuming it is the standard for WPA3. However, GCMP256 is not supported in WPA2+WPA3-Personal mixed/transition mode because older WPA2 clients cannot negotiate it, forcing the system to fall back to CCMP128.

Expert Analysis

Core Concept: Transition Mode Compatibility

WPA3 introduces stronger encryption protocols like GCMP-256 and supports CCMP-256 for enterprise environments. However, when configuring a WPA2+WPA3-Personal transition mode (also known as mixed mode), the access point must support legacy WPA2 clients. WPA2 strictly mandates AES-CCMP with 128-bit keys. Consequently, Cisco wireless controllers restrict the available encryption cipher for this hybrid policy to CCMP128 only.

Why CCMP128 is Correct

In a mixed-mode deployment, the authentication mechanism uses SAE (Simultaneous Authentication of Equals) for WPA3 clients while maintaining PSK compatibility for WPA2 devices. Because WPA2 clients cannot interpret GCMP or 256-bit CCMP suites, the controller automatically defaults to CCMP128 to ensure seamless association across all connected devices. This aligns with Cisco's explicit configuration guidelines for Personal transition policies.

Why Other Options Fail

Options A, C, and D are invalid for this scenario. CCMP256 is reserved exclusively for WPA3-Enterprise configurations. GCMP128 and GCMP256 utilize Galois/Counter Mode, which lacks backward compatibility with WPA2 infrastructure. As highlighted by community contributors, attempting to force these ciphers in a Personal transition mode will result in configuration rejection or client dropouts.

Community & Documentation Validation

Multiple verified candidates and Cisco design documents confirm that CCMP128 is the mandatory selection. Cisco's official technical references explicitly state that CCMP256 and GCMP variants are unavailable for Personal security types, cementing CCMP128 as the definitive answer.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When encountering WPA3 configuration questions, always check if the deployment specifies a transition or mixed mode. If backward compatibility with WPA2 is required, prioritize AES-CCMP 128-bit over newer ciphers like GCMP-256, as legacy client negotiation dictates the cipher selection regardless of WPA3's advanced capabilities.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. IgorLVG 👍 7 Answered B
    Chose the Encryption Cipher from the following options: CCMP128(AES) CCMP256 (not available for Personal security type) GCMP128 (not available for Personal security type) GCMP256 (not available for Personal security type)
  2. AbdullahMohammad251 👍 4 Answered B
    WPA2 supports only 128-bit encryption keys, while WPA3 supports 128, 192, and 256-bit keys. WPA3-Personal permits the use of CCMP-128 as the minimum encryption algorithm. WPA2 does not support CCMP-256 or the GCMP protocol. However, CCMP-128 is supported by both WPA2 and WPA3. https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#:~:text=The%20new%20standard%20uses%20an%20equivalent%20192%2Dbit%20cryptographic%20strength%20in%20WPA3%2DEnterprise%20mode%5B20%5D%20(AES%2D256%20in%20GCM%20mode%20with%20SHA%2D384%20as%20HMAC)%2C%20and%20still%20mandates%20the%20use%20of%20CCMP%2D128%20(AES%2D128%20in%20CCM%20mode)%20as%20the%20minimum%20encryption%20algorithm%20in%20WPA3%2DPersonal%20mode.%20TKIP%20is%20not%20allowed%20in%20WPA3.
  3. babanaber 👍 4 Answered B
    The answer is correct https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/config-guide/b_cg810/wlan_security.html#:~:text=Save%20the%20configuration.-,Configuring%20SAE%20Mixed%20Mode%20(WPA2%2BWPA3)%20(GUI),CCMP128(AES),-CCMP256%20(not%20available
  4. RickAO76 👍 4 Answered B
    - Back to B, sorry Cisco docs > open source
  5. dc583a7 👍 2
    Answer is B WPA2+WPA3-Personal Transition Mode with 6 GHz https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/wpa3-dg.html
Show 5 more comments
  1. lohitnadimpalli 👍 1
    Answer is C https://www.techtarget.com/searchsecurity/definition/WPA3 WPA3 security uses GCMP-256 encryption instead of 128-bit encryption. Additional info: CCMP256 is a cipher used only for WPA3 Enterprise security, not for WPA3 Personal. CCMP128 is the encryption cipher used for WPA2, not for WPA3.
  2. RickAO76 👍 1 Answered C
    I feel like this one is C, can not confirm
  3. CiscoTerminator 👍 5
    CCMP to CCNP, I smell a rat.
  4. yasmiine 👍 2 Answered B
    Answer B
  5. Adalberto 👍 1 Answered C
    Answear is C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What is a primary characteristic of traffic shaping?

S-grade

What is a Key Characteristic of Cisco vManage?

S-grade

What Is Achieved by This Python NETCONF XML Parsing Code?

S-grade

How to Configure VTY Lines for Idle Session Termination

S-grade

Practice All 350-401 Questions

Access 218 questions with complete answers and detailed explanations.

View Full 350-401 Practice Test →

← Back to 350-401 Study Guide