An insider at a municipal court annex runs a soft AP on a laptop that bridges the guest SSID segment onto the staff VLAN. Which attack path does this primarily represent?
Select an answer to reveal the explanation.
Short Explanation
That laptop soft AP is a secret tunnel from the lobby Wi-Fi into the clerk network—an insider building a bridge where policy said “wall.” Guest isolation dies the moment someone splices the VLANs together. This is not a harmless spectrum walk.
Full Explanation
An insider at a municipal court annex who runs a soft AP on a laptop that bridges the guest SSID segment onto the staff VLAN primarily represents an insider-facilitated WLAN bridge that bypasses guest isolation into trusted networks. The attack path is policy and segmentation bypass using wireless bridging rather than breaking cipher suites on the air. Benign spectrum analysis using only receive-only USB adapters does not bridge VLANs. Normal Passpoint roaming through a cellular ANQP query does not create guest-to-staff bridges. Controller HA failover moving CAPWAP tunnels between peers is an availability mechanism, not an insider bridge. Court annexes and other civic sites with guest Wi-Fi adjacent to staff networks are sensitive to exactly this insider shortcut. Exam caveat: detection relies on soft-AP/WIPS alerts, switchport controls, and guest isolation testing—not solely on encryption strength of the staff SSID. Operational check: enable detection of unauthorized soft APs, apply port controls that limit bridging, retest guest-to-staff isolation, investigate the insider under HR/security process, and review whether court guest access needs tighter monitoring during public hours.