A helpful intern begins scanning and attempting associations against city SSIDs without written approval, calling the activity a 'security test.' What is the correct CWSP assessment?
Select an answer to reveal the explanation.
Short Explanation
No ticket, no scope, no blessing—then it is not a pen test, it is just attacking the city’s Wi-Fi with homework energy. Get authorization first; the label 'test' does not grant a hall pass.
Full Explanation
An intern scanning and attempting associations against city SSIDs without written approval is performing an attack, not a professional security test. CWSP judgment treats authorization and scope as prerequisites; labeling the activity a test in chat does not create legal or policy permission. Intern curiosity does not override municipal acceptable-use policies or law. Seeking approval only after cracking succeeds reverses the process and maximizes harm. Exam caveat: unauthorized testing is a common ethics/process distractor—correct answers insist on prior written approval even when the actor has good intentions or an internship badge. Operational check: stop the activity, revoke elevated tool access, review logs for impact, require security awareness and authorization training before any future WLAN testing, and open an incident record if production systems were touched. Update the municipal onboarding checklist so interns receive explicit rules about wireless scanning before they receive Kali images or monitor-mode adapters. In municipal WLAN operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the infrastructure versions and client fleets used by the civic environment.