A draft WLAN risk plan proposes to 'accept WEP forever' with no isolation and no executive signature. What should the plan require instead?
Select an answer to reveal the explanation.
Short Explanation
“Accept WEP forever” with no isolation and no signature is not risk management—it is giving up in invisible ink. Either isolate and get an executive on the residual risk, or retire the crypto. Sticky notes and hidden SSIDs are not acceptance.
Full Explanation
A draft WLAN risk plan that proposes to accept WEP forever with no isolation and no executive signature must be rejected. If temporary WEP use continues, the plan requires compensating isolation and documented executive residual-risk acceptance—not silent perpetual acceptance. Hiding the WEP SSID name does not close risk. Accepting WEP forever because the PSK is under a keyboard is indefensible. Promising to revisit after the next decade without interim controls is functionally perpetual weak crypto. Exam caveat: residual risk acceptance is a formal control decision with compensating measures and authority—not a euphemism for doing nothing about deprecated WEP. Operational check: remove perpetual-accept language, add isolation/monitoring compensations, obtain executive signature with a near-term sunset, and track migration milestones. Verify weekly that the isolated WEP VLAN remains constrained until the municipal replacement project completes. In municipal WLAN operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the infrastructure versions and client fleets used by the civic environment.