A warehouse AP for city fleet tablets is proposed with a MAC allow-list as the only WLAN security control. What should the technician recommend?
Select an answer to reveal the explanation.
Short Explanation
A MAC allow-list is just a guest list written in ink anyone can photocopy. On wireless, addresses are visible and easy to clone, so it cannot stand alone—pair the warehouse SSID with real WPA2 or WPA3 security instead.
Full Explanation
A warehouse AP for city fleet tablets proposed with a MAC allow-list as the only WLAN security control must be rejected as insufficient. The technician should refuse MAC filtering as the sole security control and apply a modern WPA2 or WPA3 suite. Physically guarded buildings do not stop RF leakage to the parking lot, and MAC addresses remain spoofable on the air.
Approving the allow-list alone because warehouse APs are physically guarded confuses door locks with RF security. Keeping MAC filtering only and shortening the SSID to eight characters for secrecy adds trivial obscurity. Using MAC filtering plus WEP so older forklift scanners keep working unchanged stacks two failed controls.
Exam caveat: MAC filtering never stands alone as municipal WLAN security on CWTS exams—modern WPA2/WPA3 is required.
Operational check: deploy WPA2/WPA3 per design for fleet tablets, migrate scanners off WEP, treat any MAC list as non-authoritative inventory only, and revise the warehouse security design note accordingly. Municipal technicians document the verified setting in the as-built packet so the next shift inherits a known-good civic configuration rather than tribal knowledge. Municipal technicians document the verified setting in the as-built packet so the next shift inherits a known-good civic configuration rather than tribal knowledge.