Answer
Precedence is as follows: WPA2-AES WPA-AES WPA2-TKIP WPA-TKIP 40NBT radio (later than v 3.5.3.8) can connect to mixed mode of encryption combination - i.e. WPA/WPA2 TKIP/AES. When scanning via LCM and connect to AP with WPA/WPA2 TKIP/AES set, WPA2 AES is most favored to connect with. When manually setting a profile in LCM, a user can select all combination of encryption except WPA2 TKIP which is not supported because WiFi Alliance disallow using it in 2015 notice: https://www.wi-fi.org/downloads-public/Wi-Fi_Alliance_Technical_Note_TKIP_v1.0.pdf/17196