Which protection suite is commonly associated with WPA2 data confidentiality and integrity at the link layer?

• A. TKIP
• B. 3DES
• C. AES-CCMP
• D. WEP

Answer: (C)

WPA2’s protection at the link layer uses AES-CCMP, which combines encryption and integrity in one strong package. It uses AES for confidentiality and CBC-MAC (the CCMP part) for message integrity, providing per-packet protection against tampering and replay. This is why WPA2 is considered secure: every frame is both encrypted and authenticated, making it much harder for attackers to modify or forge data.

The other options don’t meet this strong, pairwise confidentiality and integrity requirement. WEP relies on weak IVs and a flawed integrity check, making it easily broken. TKIP was an intermediate WPA solution that still uses a weaker integrity mechanism and older RC4 encryption, and it’s not the default for WPA2. 3DES is a general-purpose cipher not designated as the WPA2 link-layer protection suite. AES-CCMP is specifically the WPA2 standard for robust link-layer security.