A hotel lobby access point permits only listed MAC addresses. An attacker clones an allowed address and joins the network. Which statement fits?
Select an answer to reveal the explanation.
Short Explanation
A name tag you can photocopy is not proof of who is wearing it. You allowed only listed hardware addresses, and the attacker cloned one and joined, which is why MAC filtering is a weak control. The lobby was not running 802.1X, a sign-in page does not encrypt the radio, and a longer network name does not stop the copy.
Full Explanation
MAC filtering admits a client only if its hardware address is on a list. A hardware address is sent in the frame and can be changed in software, so an attacker who learns an allowed address can present it and pass the check. The hotel lobby was using only that list, the attacker cloned an allowed address, and the join succeeded. The weakness is that the address can be spoofed. It is not evidence that a stronger authentication method failed. IEEE 802.1X was not configured on this access point. A method that is not in use cannot be the control that failed. 802.1X would have asked for credentials such as a certificate before opening the port, which this lobby did not do. A captive portal presents a web sign-in after the client associates. It does not encrypt the radio. Encryption comes from the wireless security mode, and a portal page would not have rejected a cloned hardware address at association time. Lengthening the network name changes a string clients must know or that is still broadcast unless hidden. It does not authenticate a hardware address and does not stop spoofing. Exam caveat: MAC filtering can still discourage casual use. It is not an identity control, and it should not be described as equivalent to 802.1X. Operational check: confirm the allowed list is the only gate, capture an association that uses a cloned address, and plan a move to 802.1X if the lobby must actually know who joined.