Testers enumerate encryption modes on city SSIDs and probe open management ports on wireless controllers before any exploitation attempts. Which pen-test phase is this?
Select an answer to reveal the explanation.
Short Explanation
Scanning is the methodical knock-and-listen step—what crypto is on each SSID, which controller ports answer—before anyone tries to break in. Skip it and you are swinging blind in city hall’s RF closet.
Full Explanation
Enumerating encryption modes on city SSIDs and probing open management ports on wireless controllers before exploitation is the scanning phase of a WLAN penetration test. Scanning turns reconnaissance inventories into concrete technical findings about AKM, ciphers, and exposed management surfaces without yet performing the attack phase. Ignoring reconnaissance and jumping straight to destructive jamming skips required process and risks uncontrolled outages. Closing the engagement with only verbal hallway comments is a documentation failure, not scanning. Issuing permanent guest vouchers is an access-operations task, not a pen-test scanning method. Exam caveat: scanning is authorized discovery against in-scope systems; it is not a license for third-party networks or for denial-of-service techniques unless those are explicitly scoped—which they usually are not on civic production WLANs. Operational check: capture encryption/AKM reports and controller management-port results in the test toolkit output, label them with timestamps and BSSIDs, and gate any attack-phase techniques on review of those scan results against county scope. Retain the scan package in the engagement archive for auditors who ask how the team selected targets.