WIPS detects a rogue AP advertising the city’s employee SSID near city hall. What response aligns with policy-driven containment?
Select an answer to reveal the explanation.
Short Explanation
A fake city SSID is a phishing billboard in RF. Trust the WIPS playbook—classify, alert, contain or yank the gear—not vibes from the NOC chair. Turning off every real AP or crowdsourcing on social media makes the incident worse.
Full Explanation
When WIPS detects a rogue AP advertising the city’s employee SSID near city hall, response should follow the approved WIPS playbook: classify the rogue, alert operators, and apply authorized containment or physical remediation. Policy-driven containment balances speed with safety and legal constraints on a public civic campus. Ignoring or freelancing responses creates either missed evil twins or reckless outages.
Ignoring the alert if signal strength is weak from the NOC desk dismisses a potentially local threat near users. Automatically shutting down all legitimate employee APs citywide to be safe causes a self-inflicted denial of service. Posting the rogue BSSID on social media and asking residents to locate it crowdsources an uncontrolled response.
Exam caveat: wireless containment may be restricted by policy or law—physical removal and switchport disable can be preferred paths when authorized. Operational check: simulate a rogue advertising the employee SSID in staging, walk the playbook classification and alert path, and confirm containment or removal actions match written authorization. In municipal WLAN programs, capture the decision in the wireless standard and re-check it at change review so the next project inherits the same control bar instead of rediscovering the failure during an outage.