A county facilities closet reveals a compromised rogue access point plugged into a live switch port on the municipal staff VLAN. Besides removing the device, which mitigation best contains the wired attachment risk?
Select an answer to reveal the explanation.
Short Explanation
Think of the rogue AP like a stranger’s garden hose spliced into the city’s water main—you do not only yank the hose; you close the valve. Shut or quarantine that switchport so the wired path cannot keep feeding the WLAN attack. Pulling the radio alone still leaves an open pipe.
Full Explanation
When a county facilities closet reveals a compromised rogue access point plugged into a live switch port on the municipal staff VLAN, removing the radio is necessary but incomplete: quarantine or shut down the switchport that hosted the rogue and document removal of the device. The wired attachment is what placed the rogue on the staff trust boundary; leaving the port enabled invites the next unauthorized bridge. Lowering AP transmit power on every city building so the rogue becomes harder to hear does not remove the Layer-2 foothold and harms legitimate coverage. Disabling WPA3 Transition Mode campus-wide until a full controller firmware rewrite ships is unrelated to containing a rogue on a staff VLAN port. Converting the staff SSID to open authentication so clients fail over to guest automatically worsens confidentiality instead of containing the incident. Civic rogue response must address both RF presence and switchport hygiene with evidence retained for facilities and security follow-up. Exam caveat: rogue mitigation pairs device removal with wired-port containment; RF-only tweaks are not sufficient when the rogue is Ethernet-attached to staff VLANs. Operational check: shut the implicated switchport, remove and tag the rogue for evidence, search for additional unknown CDP/LLDP neighbors, review port-security or 802.1X on access ports, and file an incident record that includes port, VLAN, and time of removal.