A cracked guest bridge could expose cardholder data on a city-run retail kiosk WLAN. What should loss expectancy emphasize?
Select an answer to reveal the explanation.
Short Explanation
If card data walks out a cracked guest bridge, the bill is fines, forensics, and notification—not prettier tent signs. Loss expectancy has to speak money and regulatory pain. Pretending guest Wi-Fi is magically out of scope is how cities get surprised.
Full Explanation
Loss expectancy for a cracked guest bridge that could expose cardholder data on a city-run retail kiosk WLAN must emphasize financial and regulatory loss tied to cardholder-data exposure—not merely incidental hardware cosmetics such as reprinting tent cards. Assuming zero loss because guest SSIDs are never in scope for payment rules is often false when bridges or mis-segmentation touch cardholder environments. Counting only overtime to reboot one AP ignores breach notification, fines, and forensic costs. Exam caveat: loss expectancy should reflect regulatory and business impact categories relevant to PCI-aligned civic retail, not the cheapest visible hardware cost. Operational check: estimate notification, forensic, fine, and downtime components; compare to the cost of segmentation and strong guest controls; and present figures to finance and compliance. Update the municipal payment-WLAN risk scenario library with the approved loss categories for future budgeting. In municipal WLAN operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the infrastructure versions and client fleets used by the civic environment.