Wiring-closet reviews for county buildings show many switchports enabled with no connected device. What physical/port-security practice should WLAN-supporting network teams apply?
Select an answer to reveal the explanation.
Short Explanation
An enabled empty port is an invitation with the porch light on. Shut the unused closet ports—don’t “helpfully” leave them live with a guest VLAN or a handwritten hope.
Full Explanation
Wiring-closet reviews for county buildings that show many switchports enabled with no connected device should drive WLAN-supporting network teams to administratively disable unused switchports that could otherwise feed rogue APs or unauthorized drops. An enabled empty port is an invitation with the porch light on for anyone who finds a patch cable. Disabling unused ports is basic physical and port-security hygiene that supports wireless security by starving easy wired attachment points across county facilities. Enabling every spare port with a common guest VLAN and a well-known PSK for convenience expands attack surface under the banner of helpfulness. Mirroring all unused ports to the Internet edge so idle links stay “monitored” is neither a safe nor sensible default design. Labeling unused ports “AP only” while leaving them forwarding without authentication controls provides false comfort without enforcement. Exam caveat: operational processes must re-enable ports through change control when a real AP or endpoint is installed—disabled-by-default only works if provisioning is reliable and tracked. Operational check: audit closet switches for operationally up ports with no MAC learned for a defined period, disable candidates after owner review, and re-test that a newly provisioned AP port is enabled only with the intended VLAN and security profile.