That should work if you enable VLANs. I don't have them set up on VLAN 1 since I have a separate management subnet, but it is the same deal. SSID maps to VLAN2, VLAN2 maps to a particular encryption. Vlan1 would not be assigned to any radios, but would be the native VLAN on that particular switch port and the 1242.
Randy