A parks department guest SSID uses only a captive portal for Acceptable Use acceptance. Auditors ask how RF frames are encrypted for casual visitors. What should the architect explain?
Select an answer to reveal the explanation.
Short Explanation
A splash page is a waiver at the gate, not a Faraday cage on the airwaves. Until you add OWE or a real WLAN cipher suite, open guest frames can still be sniffed. Portal acceptance and RF encryption are different controls.
Full Explanation
A parks department guest SSID that only presents a captive portal for Acceptable Use acceptance does not thereby encrypt 802.11 data frames. Portals redirect clients and gate Layer 3 or application access terms; they are not an RSN cipher suite and do not mint pairwise keys for RF confidentiality. Auditors asking how guest frames are encrypted must hear that OWE—or another appropriate WLAN cipher and AKM suite—is required for opportunistic or authenticated link encryption on open or lightly controlled guest designs. Claiming the portal alone encrypts all data frames after the splash page confuses HTTPS to the portal host with RF confidentiality for general browsing afterward. Equating MAC filtering on the portal VLAN with GCMP confuses weak, spoofable identity filtering with AES-based frame protection. Hiding the guest SSID reduces casual discovery slightly but provides no confidentiality comparable to OWE or an authenticated RSN. Exam caveat: a portal plus WPA2/WPA3-Personal or Enterprise is a different design than portal-on-open; do not assume every “guest” SSID is encrypted without reading the RSN IE and controller profile. Operational check: capture guest associations on the parks SSID and determine whether pairwise encryption is present; if frames remain open after portal acceptance, schedule OWE or an authenticated guest suite and retest before the next audit cycle.