Wireless Security Protocols: WEP to WPA3, WPS, and MAC Filtering

Wireless security protocols encrypt Wi-Fi traffic and authenticate the devices allowed to join a network. The progression runs from WEP (Wired Equivalent Privacy), which is broken and must never be deployed, through WPA (Wi-Fi Protected Access) and WPA2, to WPA3, the current standard. Alongside the protocol choice, you’ll also see convenience features and pseudo-controls — WPS (Wi-Fi Protected Setup), hidden SSIDs, and MAC filtering — that the N10-009 exam expects you to recognize as weak or outright dangerous.

The protocol timeline and what each one fixed

Each generation of wireless security exists because the previous one had a specific flaw. Knowing the flaw is what lets you answer exam questions, not just memorizing the acronym.

WEP used the RC4 stream cipher with a 24-bit initialization vector (IV) — a value that’s supposed to make each encrypted frame unique. Twenty-four bits gives only about 16.7 million possible IVs, so on a busy network they repeat within hours, and the IV is transmitted in cleartext with every frame. Reused IVs combined with RC4’s key-scheduling weaknesses let an attacker who passively captures enough traffic recover the shared key mathematically. That’s the core cryptographic failure: short, reused, cleartext IVs feeding a weak keystream. Cracking tools automate the whole process in minutes.

WPA was a stopgap that kept RC4 (so old hardware could get a firmware update) but wrapped it in TKIP (Temporal Key Integrity Protocol), which rotates per-packet keys and adds integrity checking. TKIP was later found weak as well, so treat WPA as deprecated.

WPA2 replaced RC4/TKIP with AES (Advanced Encryption Standard) using CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol). WPA2 with AES-CCMP was the workhorse standard for over a decade. Its main practical weakness is offline dictionary attacks: an attacker who captures the four-way handshake can guess passphrases at high speed against that capture, so weak passphrases fall quickly.

WPA3 fixes the handshake problem with SAE (Simultaneous Authentication of Equals), which replaces the pre-shared key handshake with a password-authenticated key exchange. SAE resists offline dictionary attacks — each guess requires a live exchange with the access point — and provides forward secrecy, meaning a passphrase compromised later can’t decrypt previously captured traffic.

Personal vs. Enterprise modes

Both WPA2 and WPA3 come in two authentication modes, and the exam loves the distinction:

• Personal mode uses a shared passphrase every user knows. In WPA2 this is called WPA2-PSK (pre-shared key); in WPA3 it’s WPA3-Personal, built on SAE. No extra infrastructure is required — this is the right answer when a scenario describes a small office or guest network with no RADIUS (Remote Authentication Dial-In User Service) server.
• Enterprise mode uses 802.1X with a RADIUS server, so each user authenticates with individual credentials or certificates via EAP (Extensible Authentication Protocol). Compromising one user’s credential doesn’t expose everyone, and access can be revoked per person. Choose Enterprise when the scenario mentions individual accountability, certificates, or an existing directory.

WPA3 also adds Enhanced Open (based on OWE, Opportunistic Wireless Encryption) for open guest networks: no password, but each client still gets encrypted traffic, so casual eavesdropping on the open network fails.

Protocol	Cipher	Key handling	Status
WEP	RC4, 24-bit IV	Static shared key	Broken — never use
WPA	RC4 + TKIP	Per-packet key mixing	Deprecated
WPA2	AES-CCMP	PSK or 802.1X; handshake vulnerable to offline guessing	Legacy-acceptable
WPA3	AES (GCMP/CCMP)	SAE (Personal) or 802.1X (Enterprise); forward secrecy	Current standard

The pseudo-controls: WPS, hidden SSIDs, and MAC filtering

WPS was designed to make joining a network easy: push a button or type an 8-digit PIN instead of a passphrase. The PIN method is the problem. The protocol validates the PIN in two halves — first four digits, then the rest — and the last digit is a checksum. That collapses the search space to roughly 11,000 attempts instead of 100 million, and the router’s response tells the attacker whether each half was right. An online brute-force recovers the PIN in hours, and the PIN then yields the actual WPA2 passphrase. Any assessment that finds WPS PIN entry enabled flags it; the fix is to disable WPS entirely.

Hiding the SSID (disabling the beacon broadcast) stops the network name from appearing in casual scan lists — and nothing more. The SSID still travels in cleartext inside probe requests, probe responses, and association frames whenever a legitimate client connects, so any passive capture tool reveals it in seconds. It’s obscurity, not security, and it can worsen your posture because configured clients probe for the hidden name everywhere they go.

MAC filtering allows only pre-approved hardware addresses to associate. But MAC (Media Access Control) addresses are transmitted unencrypted in every frame header regardless of the encryption protocol in use. An attacker sniffs the address of an approved device, then changes their own adapter’s address to match — MAC spoofing — and the filter waves them through. MAC filtering is an administrative convenience for tracking devices, not an access control that resists an adversary. For related wireless attack scenarios, see rogue APs and evil twins.

Configuration guidance that matches exam answers

When a question asks for the most secure configuration, the ranking is: WPA3-Enterprise > WPA3-Personal > WPA2-Enterprise > WPA2-Personal (AES-CCMP only) > everything else. Transitional/mixed WPA2-WPA3 mode exists for client compatibility but inherits WPA2’s weaknesses, so pure WPA3 wins when all clients support it — support that arrived alongside the newer 802.11 standards, since Wi-Fi 6 certification requires WPA3. Never select answers involving WEP, TKIP, WPS, hidden SSIDs, or MAC filtering as a security improvement — they appear as distractors.

How the N10-009 exam tests this

• “What makes WEP weak?” — a direct mechanics question. The credited answer centers on the short (24-bit), reused, cleartext initialization vectors with RC4, enabling key recovery from captured traffic — not merely “it’s old.”
• A small site wants WPA3 with one shared passphrase and no RADIUS server — the answer is WPA3-Personal, i.e., SAE mode. If the scenario adds individual user credentials or certificates, the answer flips to Enterprise/802.1X.
• A vulnerability scan flags WPS PIN entry enabled — the concern is online brute-force of the PIN (feasible because it’s validated in halves), which exposes the network passphrase; the remediation is disabling WPS.
• An attacker gets past MAC filtering — the technique is MAC spoofing: capturing an approved address from the air and cloning it. Recognize this pattern even when the word “spoofing” never appears in the stem.

Protocol-history questions are free points if you’ve drilled them — the practice exam bank makes sure you have.

For where wireless security fits in the overall exam blueprint and a domain-by-domain prep sequence, see the N10-009 study guide.

Quick reference

• WEP: RC4 with 24-bit cleartext IVs that repeat — key recoverable from captured traffic; never deploy.
• WPA: TKIP band-aid over RC4; deprecated.
• WPA2: AES-CCMP; solid cipher but handshake captures enable offline passphrase guessing.
• WPA3: SAE handshake blocks offline dictionary attacks and adds forward secrecy.
• Personal = shared passphrase, no server; Enterprise = 802.1X + RADIUS with per-user credentials.
• WPA3 Enhanced Open (OWE) encrypts traffic on open networks without a password.
• WPS PIN is brute-forceable in hours — disable it.
• Hidden SSIDs and MAC filters are trivially bypassed (probe frames reveal SSIDs; MAC spoofing beats filters).