City network engineers currently manage outdoor APs over HTTPS from the public Internet using default accounts. What management-plane hardening is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
Management belongs on a locked side street—SSH or better on a management VRF/VLAN, not the public highway with factory logins. Telnet, guest-portal admin links, and passwords in beacons are museum pieces.
Full Explanation
City network engineers managing outdoor APs over HTTPS from the public Internet using default accounts need management-plane hardening: restrict AP and controller management to SSH or equivalent secure protocols on a dedicated management VRF/VLAN with strong admin authentication. Public Internet management with defaults is an invitation. Parks and street APs especially need out-of-band or tightly controlled management paths.
Exposing Telnet on every AP so legacy scripts keep working without TLS overhead prioritizes convenience over confidentiality. Publishing controller admin URLs on the guest captive portal for transparency advertises attack surface. Storing enable passwords in beacon vendor-specific IEs for zero-touch recovery broadcasts secrets in RF.
Exam caveat: jump hosts and MFA for administrators complement protocol and VRF controls. Operational check: confirm management interfaces are unreachable from guest and Internet paths, succeed via the management VRF with strong auth, and fail default-account login. In municipal WLAN programs, capture the decision in the wireless standard and re-check it at change review so the next project inherits the same control bar instead of rediscovering the failure during an outage. In municipal WLAN programs, capture the decision in the wireless standard and re-check it at change review so the next project inherits the same control bar instead of rediscovering the failure during an outage.