Which statement characterizes WEP encryption?

Which statement characterizes WEP encryption?

• A. Uses GCMP-256
• B. Uses EAP or RADIUS for centralized client authentication
• C. It is widely considered obsolete due to vulnerabilities
• D. Allows Kerberos authentication

Answer: (C)

WEP encryption is widely considered obsolete because of inherent weaknesses in its design that make it insecure for modern networks. It uses RC4 for encryption along with a 24-bit initialization vector, which is sent in the clear. On busy networks the same IV will repeat, allowing an attacker to collect enough packets and reconstruct the key, effectively breaking confidentiality. It also relies on a simple CRC-32 for integrity, which does not provide real protection against tampering. These flaws mean WEP can be cracked with readily available tools, so it has been replaced by stronger standards like WPA/WPA2 (and WPA3) that use per-session keys and stronger authentication. The other statements don’t describe WEP accurately: GCMP-256 and centralized EAP/RADIUS are features of newer security protocols, and Kerberos authentication is not part of WEP.

WEP encryption is widely considered obsolete because of inherent weaknesses in its design that make it insecure for modern networks. It uses RC4 for encryption along with a 24-bit initialization vector, which is sent in the clear. On busy networks the same IV will repeat, allowing an attacker to collect enough packets and reconstruct the key, effectively breaking confidentiality. It also relies on a simple CRC-32 for integrity, which does not provide real protection against tampering. These flaws mean WEP can be cracked with readily available tools, so it has been replaced by stronger standards like WPA/WPA2 (and WPA3) that use per-session keys and stronger authentication. The other statements don’t describe WEP accurately: GCMP-256 and centralized EAP/RADIUS are features of newer security protocols, and Kerberos authentication is not part of WEP.