Auditors ask whether Management Frame Protection (PMF / 802.11w) is enabled on SSIDs that require it. What should the WLAN security design validate?
Select an answer to reveal the explanation.
Short Explanation
PMF puts armor on management frames so cheap deauth tricks hurt less. Where WPA3 and policy say it is required, turn it on and verify it. Longer DHCP leases are not a substitute.
Full Explanation
Auditors asking whether Management Frame Protection (PMF / 802.11w) is enabled on SSIDs that require it should drive validation that PMF is enabled where policy and modern WPA3/enterprise profiles require protected management frames. PMF mitigates certain spoofed deauth/disassoc classes that classic open management frames allow. Civic high-security and WPA3 SSIDs increasingly treat PMF as baseline, not optional garnish.
Claiming PMF is obsolete and should be disabled whenever WIPS is licensed confuses detection with prevention. Replacing PMF with longer DHCP leases to reduce deauth effectiveness misunderstands both mechanisms. Enabling PMF only on printers because phones cannot parse robust management frames invents a false client limitation as policy.
Exam caveat: some legacy clients mishandle PMF—use required vs optional carefully and exception-list true incompatibilities. Operational check: inspect SSID security settings for PMF mode on WPA3/enterprise profiles, test join with a known-good client, and confirm deauth spoof resilience improves in a controlled lab test. In municipal WLAN programs, capture the decision in the wireless standard and re-check it at change review so the next project inherits the same control bar instead of rediscovering the failure during an outage.