This WGB (Workgroup Bridge) design scenario requires satisfying multiple simultaneous constraints. EAP-FAST (Flexible Authentication via Secure Tunneling) is the correct authentication protocol because it provides enterprise-grade 802.1X security using protected access credentials (PAC) without requiring a certificate to be installed on each AP or WGB device — directly satisfying the enterprise-grade security without certificates requirement. EAP-TLS (Options B and D) requires client certificates on every authenticating device, which is explicitly excluded. Mobile station mode is required rather than static mode (Options C and D) because mobile station mode enables the WGB to aggressively scan and roam to optimal mesh neighbors dynamically, evaluating neighbor signal quality and switching to better RAPs/MAPs as the truck moves along its path. Static mode fixes the WGB to a specific channel or AP, preventing the aggressive scanning and roaming required for the latency-sensitive application. The dot1q-capable switch connection supports multiple clients in different VLANs via 802.1Q VLAN tagging between the WGB and the truck ' s local network switch. Reference: WLSD Study Guide — Workgroup Bridge Design, EAP-FAST Authentication, Mobile vs. Static WGB Mode, Industrial Wireless Design.