What is a best practice for wireless network security?

What is a best practice for wireless network security?

• A. Hide the SSID to fully protect the network.
• B. Use WEP for compatibility.
• C. Use strong WPA2/WPA3 encryption with a strong passphrase.
• D. Use MAC filtering as the sole protection.

Answer: (C)

The main idea is that robust wireless security comes from strong, current encryption paired with a long, complex passphrase. Using WPA2 or WPA3 with a strong password protects both the data traveling over the air and who can join the network, making unauthorized access much harder. WPA3 offers improvements in handshake security and resilience, and if devices support it, it’s the best choice. A strong passphrase—long, random, and unique—keeps attackers from guessing or brute-forcing access. Hiding the network name (the SSID) isn’t a reliable defense; it may hide the network from casual scans but doesn’t stop determined attackers who can still detect and target the network. MAC filtering, where only certain device addresses are allowed, is also weak because MACs can be spoofed, and it doesn’t protect the traffic itself. WEP is outdated and has known vulnerabilities that make it easy to break into. So none of these options provide the level of protection that a strong, modern encryption and passphrase do. If possible, enable the latest supported security standard and use a password that’s hard to guess. For added protection, also disable features like WPS, keep firmware up to date, and consider a separate guest network for visitors.

The main idea is that robust wireless security comes from strong, current encryption paired with a long, complex passphrase. Using WPA2 or WPA3 with a strong password protects both the data traveling over the air and who can join the network, making unauthorized access much harder. WPA3 offers improvements in handshake security and resilience, and if devices support it, it’s the best choice. A strong passphrase—long, random, and unique—keeps attackers from guessing or brute-forcing access.

Hiding the network name (the SSID) isn’t a reliable defense; it may hide the network from casual scans but doesn’t stop determined attackers who can still detect and target the network. MAC filtering, where only certain device addresses are allowed, is also weak because MACs can be spoofed, and it doesn’t protect the traffic itself. WEP is outdated and has known vulnerabilities that make it easy to break into. So none of these options provide the level of protection that a strong, modern encryption and passphrase do.

If possible, enable the latest supported security standard and use a password that’s hard to guess. For added protection, also disable features like WPS, keep firmware up to date, and consider a separate guest network for visitors.