AP management planes in city halls still allow HTTP, Telnet, and SNMPv1. What hardening step is required?
Select an answer to reveal the explanation.
Short Explanation
Managing APs with Telnet and SNMPv1 is like shouting admin passwords across the lobby. Turn off the cleartext relics and use HTTPS/SSH/SNMPv3. Sharing the guest Wi-Fi password as the admin password is a bonus own-goal.
Full Explanation
AP management planes in city halls that still allow HTTP, Telnet, and SNMPv1 expose credentials and configuration in cleartext on paths attackers love. Hardening requires disabling HTTP, Telnet, and SNMPv1 and requiring encrypted management such as HTTPS/SSH and SNMPv3 where SNMP is used. Civic controller and AP management often sits closer to user VLANs than operators admit; cleartext admin protocols are unjustifiable.
Exposing those protocols on the guest SSID for easier field support is actively hostile to security. Preferring cleartext Telnet over SSH because it is easier to script prioritizes convenience over confidentiality. Setting management passwords to match the WPA2 guest passphrase couples unrelated trust domains.
Exam caveat: move management onto a dedicated management VRF/VLAN in addition to encrypting protocols—encryption without isolation is incomplete. Operational check: scan AP/controller management addresses for open Telnet/HTTP/SNMPv1, confirm only SSH/HTTPS/SNMPv3 remain, and verify admin login works via the management network only. In municipal WLAN programs, write the control into standards and verify it during change review so the next project inherits the same bar rather than rediscovering the failure mode under outage pressure.