A construction vendor plugs an unmanaged consumer AP into a city building VLAN without change control. How should this be classified and handled?
Select an answer to reveal the explanation.
Short Explanation
Mystery APs on city VLANs are shadow IT with antennas. Pull them, investigate, and make vendors use the onboarding path. Turning WIPS off for temporary gear is how temporary becomes permanent.
Full Explanation
A construction vendor plugging an unmanaged consumer AP into a city building VLAN without change control should be classified as unauthorized wireless infrastructure / shadow IT, then disconnected and investigated under WLAN onboarding policy. Temporary job-site convenience is a leading source of rogue bridges onto civic LANs. Policy must treat “it’s only for the contractors” as still in scope for security.
Congratulating the vendor for improving coverage and adding the AP to production monitoring later blesses shadow IT. Extending the AP’s guest SSID into the police evidence VLAN for convenience is a severe trust violation. Disabling WIPS rogue detection so temporary construction APs never alert removes the safety net.
Exam caveat: offer a sanctioned temporary coverage process with approved APs and VLANs so vendors have a legitimate path. Operational check: disconnect the consumer AP, document the switchport and VLAN involved, open an incident/change record, and brief facilities/vendors on the approved temporary Wi-Fi request path. In municipal WLAN programs, capture the decision in the wireless standard and re-check it at change review so the next project inherits the same control bar instead of rediscovering the failure during an outage.