A warehouse barcode scanner cannot support WPA3 and must remain on a constrained SSID. How should the exception be handled?
Select an answer to reveal the explanation.
Short Explanation
Legacy gear gets a ticket with an expiration date and extra fences—not a free pass to the crown jewels. Write the exception, isolate it, watch it, replace it. Secret exceptions and MAC cloning are how audits go sideways.
Full Explanation
A warehouse barcode scanner that cannot support WPA3 and must remain on a constrained SSID should be handled with a documented, time-bounded risk acceptance plus compensating controls such as an isolated VLAN, ACLs, and monitored WPA2 until replacement. Exceptions are normal in civic device fleets; unmanaged forever-exceptions are not. The goal is continued operations without quietly granting the weak client the keys to the kingdom.
Granting the scanner unrestricted access to the domain-admin VLAN as compensation is privilege escalation dressed as pragmatism. Hiding the exception from audit so it does not appear on risk registers destroys governance. Cloning the scanner MAC onto every AP radio to bypass authentication forever invents a permanent backdoor.
Exam caveat: time-bounded means an owner, an expiry date, and a replacement work item—not a sticky note that says temporary. Operational check: confirm the scanner SSID maps to an isolated VLAN with deny-by-default ACLs, WIPS/monitoring covers it, and the risk register shows expiry and compensating controls. In municipal WLAN programs, capture the decision in the wireless standard and re-check it at change review so the next project inherits the same control bar instead of rediscovering the failure during an outage.