ExamFinch.com My Study

Study guide

Wireless Security and Enterprise Network Design

Practice this exam

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Wireless Security and Enterprise Network Design

Key Takeaways Explain This Topic AI

WPA3 replaces the WPA2 pre-shared-key handshake with Simultaneous Authentication of Equals (SAE), resisting offline dictionary attacks.

WPA2/WPA3-Enterprise uses 802.1X with RADIUS and EAP for unique per-user or per-device authentication and role-based VLAN assignment.

Guest wireless must map to an isolated VLAN with internet-only access; a captive portal handles onboarding, not encryption.

Rogue access points and evil twins are countered with a Wireless Intrusion Prevention System (WIPS), 802.1X, switch port security, and certificate validation.

Enterprise design layers wireless controls with segmentation, NAC, SNMPv3, SSH/HTTPS management, centralized logging, and time synchronization.

Last updated: June 2026

Securing the Air

Wireless extends the enterprise boundary into open space, so SY0-701 expects authentication, encryption, segmentation, management, and monitoring to all be addressed. The single biggest concept shift is WPA2 to WPA3 .

Wireless Security Options

  • Option Use case Security note
  • WPA3-Enterprise Modern 802.1X enterprise auth 192-bit mode available; strongest where supported
  • WPA2-Enterprise 802.1X enterprise auth Common business baseline
  • WPA3-Personal Home/small office Uses SAE (Dragonfly), resists offline cracking
  • WPA2-Personal Shared passphrase Vulnerable to offline PSK capture and KRACK
  • Captive portal Guest onboarding / terms Not encryption, not segmentation
  • Open network Public convenience Assume traffic is observable unless upper-layer encryption protects it

WPA3 specifics: Personal mode swaps WPA2's 4-way pre-shared-key handshake for Simultaneous Authentication of Equals (SAE) , defeating offline dictionary attacks even on weak passphrases, and adds forward secrecy. WPA3-Enterprise adds an optional 192-bit security suite. WPS (the push-button/PIN setup) is brute-forceable and should be disabled.

802.1X and EAP

802.1X uses three roles: the supplicant (client), the authenticator (switch or wireless controller), and the authentication server (RADIUS). Common EAP methods: EAP-TLS (mutual certificates, strongest), PEAP and EAP-TTLS (server cert plus tunneled credentials), and the legacy EAP-FAST . Certificate-based EAP-TLS prevents credential theft and underpins evil-twin resistance.

Wireless Controls

  • Risk Control
  • Shared password reuse WPA2/WPA3-Enterprise with 802.1X
  • Rogue access point WIPS, controller detection, switch port security
  • Guest reaching internal systems Guest SSID mapped to isolated VLAN
  • Weak management access Admin MFA, management VLAN, SSH/HTTPS
  • Coverage gaps causing workarounds Site survey, AP placement, capacity planning
  • Evil twin / rogue captive portal Certificate validation, trusted-SSID config, user training
  • SSID-to-VLAN Mapping
  • SSID Authentication VLAN Access
  • Corp WPA2/WPA3-Enterprise, 802.1X Role-based employee VLAN Internal apps by role
  • Corp-IoT Device certificates or MAB IoT VLAN Required services only
  • Guest Captive portal / sponsored Guest VLAN Internet only
  • Admin Strong auth, few users Management VLAN Network management only

The SSID name is not the boundary. The mapped VLAN, firewall rules, identity policy, and monitoring enforce it.

  • Enterprise Network Design Checklist
  • Redundant edge firewalls/routers where availability demands it
  • Segmentation across user, server, management, guest, and IoT zones
  • Centralized authentication (RADIUS/TACACS+) for access and administration
  • Secure management protocols: SSH and HTTPS, never Telnet or HTTP
  • SNMPv3 (authentication and encryption) instead of SNMPv1/v2c
  • Centralized logging plus NTP time synchronization for correlation
  • Documented IP addressing, routing, and change control
  • Monitoring for rogue devices, anomalous traffic, and failed authentications
  • PBQ Wireless Scenario

One shared Wi-Fi password serves employees, contractors, printers, and guests; guests can reach file shares; a rogue AP was found under a desk. Best redesign: (1) employee SSID on WPA2/WPA3-Enterprise with 802.1X; (2) guest SSID on an internet-only VLAN; (3) printers/IoT in a restricted device VLAN; (4) NAC or controller policy for role-based access; (5) enable rogue-AP detection and trace the switch port; (6) restrict controller administration to the management network with MFA. Merely rotating the shared password creates no accountability or segmentation.

Wireless Exam Traps

Captive portal equals encryption - false; it only handles onboarding/terms.

Hidden SSID is strong security - false; clients still beacon and reveal it.

MAC filtering is authentication - weak; MAC addresses are trivially spoofed.

Different password means guests can share the employee VLAN - false; isolation requires segmentation, not a separate passphrase.

Wireless security ends at the AP - false; it includes the controller, switch ports, RADIUS, certificates, logs, and firewall rules.

Wireless Attacks SY0-701 Names

Evil twin: a rogue AP broadcasting a legitimate SSID to harvest credentials. Defense: EAP-TLS certificate validation so clients reject the impostor's server certificate.

Disassociation/deauthentication attack: spoofed management frames knock clients offline, often as a prelude to capturing the reconnection handshake or forcing users onto an evil twin. 802.11w (management frame protection) mitigates it.

Rogue AP: any unauthorized AP plugged into the wired network, found via WIPS and switch port security.

Jamming: radio interference denying service; located with spectrum analysis and a site survey.

RFID/NFC and Bluetooth attacks: bluejacking sends unsolicited messages, bluesnarfing steals data; keep devices non-discoverable and patched.

Site Survey and RF Planning

A proper deployment starts with a site survey that measures coverage, signal-to-noise ratio, and interference. Plan non-overlapping channels (1, 6, 11 in 2.4 GHz) to avoid co-channel interference, tune transmit power so coverage does not bleed into a parking lot, and design for capacity, not just coverage, in dense areas. A heat map documents expected signal strength so weak spots that tempt users into insecure workarounds are eliminated. Controllers should support fast, secure roaming (802.11r) so 802.1X clients move between APs without re-authenticating from scratch.

Putting Enterprise Design Together

The strongest SY0-701 answers combine these layers rather than relying on one. Authentication via 802.1X and certificates, encryption via WPA3, segmentation via SSID-to-VLAN mapping and NAC, secure management via SNMPv3 and SSH on a dedicated management VLAN, and visibility via WIPS, centralized logging, and NTP-synchronized timestamps together form a defensible wireless and network architecture. Any single control, such as a strong passphrase or a hidden SSID, is never the complete answer.