A city’s public downtown Wi-Fi team wants guests to connect without a shared passphrase, but they refuse to leave the lobby SSID as plaintext open air. Which modern secure technology should the technician prefer when the platform supports it?

When a city’s public downtown Wi-Fi team wants guests to connect without a shared passphrase yet refuses a classic plaintext-open lobby SSID, Opportunistic Wireless Encryption (OWE) is the modern secure technology to prefer when the platform supports it. OWE provides encryption for open-style onboarding without posting a PSK on a kiosk flyer, closing the eavesdropping exposure of traditional open networks while preserving easy public association for civic guests.

WEP with a rotating guest key posted on the kiosk fails because WEP is obsolete and broken; rotating a weak key does not rehabilitate it for municipal guest air. WPA-Personal with a short shared passphrase printed on a flyer fails by concept: a public PSK becomes shared knowledge, is hard to rotate safely, and still is not the “no passphrase” open experience the city asked for. MAC filtering alone with the SSID left fully open and unencrypted fails because MAC lists do not encrypt traffic and do not stop sniffing of plaintext frames on an open BSS.

Exam caveat: distinguish classic open (no encryption) from encrypted-open/OWE. CWTS public-use questions often test whether candidates pick OWE over WEP, short guest PSKs, or MAC-only theater.

Operational check: confirm controller/AP support for OWE on the downtown guest SSID; enable OWE instead of open/plaintext; verify a test phone associates without a PSK and that traffic is encrypted; document that WEP and flyer PSKs are out of policy for this civic guest service.