A city retail concession on the waterfront must process card payments over Wi-Fi for POS tablets. Which WLAN security requirement best reflects PCI-DSS expectations for that wireless path?
Select an answer to reveal the explanation.
Short Explanation
Picture the POS tablets as a cash drawer sitting in the open air—PCI cares that card data isn't floating past shoppers on an open SSID. Put the payment WLAN behind real encryption, keep it off the guest network, and watch it like the rest of the card environment.
Full Explanation
For a waterfront municipal retail concession that processes card payments on POS tablets over Wi-Fi, PCI-DSS expectations map to confidentiality and segmentation of the cardholder data environment, not to convenience networking. Strong encryption on the payment WLAN, isolation of that segment from guest and general public SSIDs, and monitoring aligned to the payment security program are the requirements that keep cardholder data from riding the same trust boundary as casual browsing. Captive-portal splash pages alone do not encrypt card traffic or segment the CDE; they only present terms of use. Banning Wi-Fi and pushing every POS tablet onto unmanaged public cellular without a wireless security policy trades one uncontrolled path for another and fails to document how payment traffic is protected. Documenting only RF channel plans and AP mounting heights addresses coverage, not PCI wireless controls—PCI does address wireless when card data traverses it. Exam caveat: PCI wording and SAQ scope vary by merchant level and whether WLAN is in scope of the CDE; the principle remains encryption plus segmentation plus monitoring, not RF aesthetics. Operational check: verify the POS SSID uses approved cipher suites, confirm Layer-2/Layer-3 isolation from guest VLANs with a controlled test, and confirm IDS/IPS or WLAN monitoring covers that SSID in the payment program evidence pack.