A company with 465 employees wants to deploy an open WLAN for guests. The company wants the experience to be as follows: Guests select the WLAN and connect without having to enter a password. Guests are redirected to a welcome web page and log in. The company also wants to provide encryption for the network for devices that are capable. Which security options should you implement for the WLAN?

The requirements are an open network (no password), a redirect for login (captive portal), and encryption for capable devices. Opportunistic Wireless Encryption (OWE), also known as Wi-Fi Enhanced Open, provides individualized encryption on open networks, preventing passive eavesdropping. "OWE Transition Mode" is critical as it advertises both an open SSID for legacy clients and a hidden OWE-enabled network for capable clients, ensuring all guests can connect while providing encryption to those that support it. This combination perfectly matches all stated requirements.

A. WPA3-Personal requires a pre-shared key (password), which violates the "connect without a password" requirement.
B. WPA3-Personal requires a password, which is not desired for the initial connection in this guest scenario.
C. WPA3-Personal requires a password. MAC authentication is a Layer 2 authentication method, not an encryption scheme for open networks.

Wi-Fi Alliance®, "Wi-Fi CERTIFIED Enhanced Open™: Technology Overview" (2018), Pages 1-2. This official whitepaper explains that OWE provides data protection in open networks and that "OWE transition mode enables a gradual deployment of OWE by allowing OWE and non-OWE clients to connect to the same network."

ArubaOS 8.6.0.0 User Guide, Page 483. The guide describes "Enhanced Open (OWE)" and states that "OWE transition mode allows both OWE and non-OWE STAs to connect to the same SSID." This directly supports using transition mode for backward compatibility.