Unauthorized wireless access points keep appearing in an office, plugged in by employees who want better coverage, and the security team wants them detected and automatically contained without walking the floor. Which control best fits?
Select an answer to reveal the explanation.
Short Explanation
You need a guard who watches the airwaves, not just your own network. A WIPS listens to every radio around, spots access points that aren't on your approved list, and moves to contain them. WPA3 protects your own access points, but it can't see the rogue one somebody plugged in under a desk.
Full Explanation
A wireless intrusion prevention system uses dedicated sensors or access point radios to monitor the radio spectrum continuously, compare detected access points against an inventory of authorized devices, and flag rogue or unauthorized ones. Many systems can also correlate the rogue device to the wired switch port it is plugged into and take containment actions, which meets the requirement for automatic detection without manual surveys. Enabling WPA3 strengthens authentication and encryption on the company's own access points, but a rogue access point is a separate device with its own settings, so the corporate SSID's security does nothing to detect or stop it. A captive portal controls guest onboarding to the sanctioned wireless network by presenting terms or a login page; it has no visibility into other access points broadcasting nearby. A host-based firewall on each laptop filters traffic to and from that laptop, which can reduce exposure if a user connects to a rogue network, yet it neither detects nor contains the rogue device itself. Exam caveat: some containment techniques can interfere with neighboring networks, so policies should restrict automatic containment to devices confirmed to be connected to the corporate wired network. Operational check: plug an unapproved test access point into a corporate port, confirm the system raises a rogue alert identifying its switch port, and verify containment occurs.