Operations wants to call MAC filtering the primary security control for a field-office WLAN. What is the accurate assessment?
Select an answer to reveal the explanation.
Short Explanation
MAC addresses ride in the clear like name tags at a conference—trivial to copy. Filtering on them is not modern wireless security, just a speed bump. Do not let anyone crown MAC filtering as the main lock on a municipal SSID.
Full Explanation
Operations wanting to call MAC filtering the primary security control for a field-office WLAN must hear an accurate assessment: MAC filtering is easily spoofed and must not be relied on as modern WLAN security. Wireless MACs are visible on the air, so allow-lists provide accountability theater more than confidentiality. Civic field offices need WPA2/WPA3 (Personal or Enterprise per design), not address filters as the main gate.
Equating MAC filtering with WPA3-SAE for encryption strength confuses address filtering with authenticated encryption. Claiming MAC filtering prevents all spoofing because addresses are secret is false on open RF. Saying MAC filtering is required before captive portals will function invents a dependency that is not generally true.
Exam caveat: MAC filtering is a weak auxiliary control at best—never the primary municipal WLAN security control on CWTS items.
Operational check: reject MAC filtering as primary security, deploy the designed WPA2/WPA3 mode with a strong passphrase or 802.1X, optionally keep MAC lists only as non-authoritative inventory aids, and update the field-office security checklist accordingly. Municipal technicians document the verified setting in the as-built packet so the next shift inherits a known-good civic configuration rather than tribal knowledge.