A municipal library’s public SSID experiences repeated client disconnect storms consistent with spoofed deauthentication frames. Which mitigation pair best reduces impact?
Select an answer to reveal the explanation.
Short Explanation
Deauth storms are like someone yanking the Ethernet cable over and over from across the room. Protected management frames help stop the fake 'hang up' messages, and a sharp WIPS alert tells you it is happening before the reading-room Wi-Fi becomes a joke.
Full Explanation
Spoofed deauthentication and disassociation frames disrupt client associations when management frames are unprotected, which is a common denial-of-service pattern on public library SSIDs. The sound mitigation pair is to enable management frame protection (IEEE 802.11w / protected management frames) on capable infrastructure and clients so forged deauth frames are rejected, and to ensure WIPS alerting fires quickly on deauth floods so operators can locate the jammer or spoofing source. Switching permanently to WEP does not ignore deauth meaningfully and reintroduces deprecated confidentiality failure. Lowering AP transmit power alone may shrink coverage but does not authenticate management frames or provide detection. Disabling logging hides patron-impacting disconnect storms from operations and auditors without reducing attack success. Exam caveat: PMF requires client and AP support; mixed environments may need phased enablement, and WIPS detection remains valuable where legacy clients cannot yet enforce protected management frames. Operational check: confirm PMF capability and policy on library APs and representative patrons' devices, generate a controlled test deauth (within authorization) or review WIPS signatures, and verify alerts reach the municipal NOC with BSSID context. Document residual risk for any legacy readers that cannot enable PMF so the library WLAN risk plan does not silently accept unprotected management frames as a permanent baseline.