A public library wants open guest Wi-Fi without a shared password, yet still needs encryption on the air. What should the design use?
Select an answer to reveal the explanation.
Short Explanation
Open guest Wi-Fi used to mean everyone could eavesdrop like it was AM radio. OWE keeps the “no password” convenience but wraps the air in encryption. Table-tent PSKs and staff-VLAN bridges are how libraries get headlines for the wrong reasons.
Full Explanation
A public library that wants open guest Wi-Fi without a shared password, yet still needs encryption on the air, should use Opportunistic Wireless Encryption (OWE) for enhanced open access. OWE provides per-association encryption without distributing a PSK on table tents, which fits civic guest goals of low friction plus confidentiality against passive eavesdropping. It is the standards-based answer when open for joining must not mean clear on the air.
WPA2-PSK with the passphrase printed on every table tent recreates a shared secret everyone can read and crack offline after a handshake. WEP shared-key mode advertised as library-open uses broken crypto. Disabling all encryption and bridging guests straight onto the staff VLAN collapses both confidentiality and segmentation.
Exam caveat: OWE still requires client support and does not replace client isolation, content filtering, or portal policy where those are mandated. Operational check: enable OWE on a pilot guest SSID, verify capable clients show encrypted associations without a PSK prompt, and confirm guest traffic remains segmented from staff VLANs. In municipal WLAN programs, write the control into standards and verify it during change review so the next project inherits the same bar rather than rediscovering the failure mode under outage pressure.