An auditor notes that unused Ethernet wall jacks in a civic center could let someone plug in a rogue AP. Which wired support control best addresses that physical attachment risk at the switch edge?
Select an answer to reveal the explanation.
Short Explanation
Rogue APs love lonely wall jacks. Port security and 802.1X on the switch are the bouncers at the Ethernet door—hiding an SSID or whispering the RF quieter doesn’t stop a cable plug-in.
Full Explanation
When an auditor notes that unused Ethernet wall jacks in a civic center could let someone plug in a rogue AP, the wired support control that best addresses that physical attachment risk is physical port security and/or 802.1X on AP-facing and user switchports so unauthorized devices cannot easily join the wired edge. Rogue APs love lonely live jacks; authenticating or restricting those ports closes the path from a public corridor cable to a hostile BSS bridged onto municipal VLANs. Relying solely on hiding the staff SSID does not stop a rogue AP that attaches on the wired side and can bridge or advertise whatever name it wants. Lowering all AP transmit power to 1 dBm does not make rogue Ethernet attachments irrelevant to campus security. Disabling WPA3 everywhere so monitoring tools can see cleartext rogue beacons weakens legitimate networks and misunderstands containment strategy. Exam caveat: port security must cover both labeled AP ports and general user ports; attackers will not limit themselves to drops that facilities marked “AP only” in a busy civic center. Operational check: sample unused jacks in public corridors, confirm they are disabled or 802.1X-controlled, attempt to connect a lab mini-AP without authorization, and verify the switch blocks forwarding before the device can bridge onto production VLANs.