A transit-yard manager asks why MAC filtering alone cannot stop a cloned tablet address on the yard Wi-Fi. What is the best explanation?
Select an answer to reveal the explanation.
Short Explanation
On Wi-Fi the badge number is printed on the outside of the envelope. Anyone sniffing can copy a permitted MAC and walk right past a filter that trusts addresses alone—so explain spoofability, not mythical encryption of the MAC.
Full Explanation
Transit-yard managers asking why MAC filtering alone cannot stop a cloned tablet address need a clear RF reality: wireless MAC addresses are visible on the air and can be spoofed to match the allow-list. Filtering therefore fails as sole protection for yard Wi-Fi that may carry operational apps. Municipal yards need cryptographic authentication such as WPA2/WPA3, not address theater.
Claiming MAC addresses are encrypted inside every 802.11 data frame so cloning is impossible is false for the exposed MAC headers used in filtering. Saying MAC filtering secretly negotiates WPA3-SAE invents crypto the filter does not perform. Claiming allow-lists live only in a cloud controller and cannot be read over the air ignores that attackers observe client MACs on the RF, not the controller database.
Exam caveat: spoofability of visible MACs is why MAC filtering fails as primary WLAN security.
Operational check: explain spoofing with a controlled demo if policy allows, replace MAC-primary designs with WPA2/WPA3 for yard tablets, and update the transit WLAN standard to forbid allow-list-only SSIDs. Municipal technicians document the verified setting in the as-built packet so the next shift inherits a known-good civic configuration rather than tribal knowledge.