A city WLAN team wants one management-plane hardening baseline for controllers and APs. Which combination best matches preventative practice?

For municipal WLAN management-plane hardening, the best preventative practice combines management-plane access control lists (ACLs) with disabling insecure protocols such as Telnet, HTTP, and SNMPv1/v2c, favoring secure alternatives like SSH, HTTPS, and SNMPv3. ACLs restrict management access to authorized IP addresses or networks, reducing the attack surface by blocking unauthorized hosts. Disabling Telnet and HTTP eliminates unencrypted management traffic vulnerable to interception and credential theft. Replacing SNMPv1/v2c with SNMPv3 ensures management data is authenticated and encrypted. Using insecure protocols for compatibility sacrifices security and invites exploitation. Opening management interfaces to the Internet with default passwords is a critical misconfiguration that exposes devices to remote compromise. Bridging guest SSIDs into out-of-band management VLANs undermines network segmentation and exposes management traffic to untrusted clients, violating best practices. It is important to note that implementing ACLs requires careful planning to avoid locking out legitimate administrators. Operationally, administrators should verify that management interfaces accept connections only from authorized networks using secure protocols and that insecure services are disabled, confirming compliance with the hardening baseline.