City SOC requirements say the WLAN monitoring system must alert when a rogue AP advertises the same corporate SSID. Leadership offers only switch SNMP uptime polls. What capability gap must be closed?
Select an answer to reveal the explanation.
Short Explanation
Uptime pings tell you a switch is alive—they do not notice an evil twin yelling your SSID in the lobby. You need WIPS-class wireless monitoring for that alert. Hiding the SSID does not retire the requirement.
Full Explanation
City SOC requirements to alert when a rogue AP advertises the same corporate SSID demand wireless threat monitoring such as WIPS or an equivalent wireless IDS/IPS capability. Same-SSID evil twins are an RF and beacon problem on the air; switch SNMP uptime polls only report whether a managed wired device answers and cannot decode 802.11 advertisements in the lobby or council chambers. That capability gap must be closed before leadership claims the corporate SSID is adequately monitored. SNMP uptime polls do not decode 802.11 beacons for rogue SSIDs no matter how frequently they run. Increasing syslog facility numbers on printers does not create wireless threat detection. Hiding the corporate SSID does not eliminate evil-twin risk and does not retire the SOC’s detection requirement for same-SSID impostors. Exam caveat: WIPS alerts need tuned response playbooks—detection without wired containment options, location context, or an incident process still leaves the city exposed after the page fires. Operational check: authorize a controlled test AP advertising the corporate SSID in a lab or after-hours area and confirm the monitoring system alerts the SOC with usable sensor or location context inside the agreed SLA before declaring the control operational.