End-of-support wireless access points remain in city lobby SSIDs and no longer receive security patches. Which lifecycle action is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
An access point past support is a door lock the vendor won’t make keys for anymore. Replace it or fence it off—don’t leave lobby Wi-Fi hanging on gear that can’t get fixes.
Full Explanation
End-of-support wireless access points in city lobby SSIDs no longer receive security patches for newly disclosed flaws in wireless stacks, management services, or cryptographic implementations. Lifecycle hygiene demands replacement or isolation so lobby wireless does not depend on unpatchable components that sit at the edge of citizen and visitor connectivity. Signal strength that still meets coverage maps does not equal a maintainable security posture; unsupported radios become permanent exceptions that audits and attackers both notice.
Keeping them indefinitely because coverage maps still look green prioritizes RF aesthetics over patchability. Moving end-of-support APs exclusively onto the PCI payment VLAN concentrates unpatchable risk into the most sensitive wireless zone—an inversion of isolation goals. Disabling all logging on aging APs to extend hardware life removes detection just when those devices are least trustworthy.
Exam caveat: CISSP operations security treats end-of-life systems as elevated risk requiring upgrade, replacement, or strict compensating isolation. Migrating fragile gear into higher-sensitivity segments is never a fix.
Operational check: inventory AP models and vendor end-of-support dates; prioritize lobby and guest SSID replacements; isolate any interim holdouts from payment and staff SSIDs; keep logging enabled; and track firmware currency as a control metric.