Public festival planners ask how to keep the guest SSID from becoming a management back door into city APs. Which public-use practice should the technician apply?
Select an answer to reveal the explanation.
Short Explanation
Guests stream; they do not configure the AP. Keep management off the public SSID, segment the carnival traffic, and never hand out admin passwords with the funnel cakes.
Full Explanation
Public festival planners keeping the guest SSID from becoming a management back door into city APs need segmentation and rate-limiting of public traffic, and must not expose AP management on the guest SSID. Guests consume internet; they must not reach HTTPS/SSH management planes or hold admin passwords. Technician public-use practice treats management reachability as a separate trust domain from carnival Wi-Fi.
Advertising the AP’s HTTPS management UI as the captive portal homepage fails by putting admin interfaces in front of every attendee. Putting SSH and HTTPS management on the same SSID guests use for video streaming fails by concept: shared SSID adjacency invites scanning and credential attacks against management. Giving every guest the AP admin password for self-service channel changes fails operational security entirely.
Exam caveat: CWTS public-use items often test management plane separation. Captive portals are for terms/login—not for AP admin UIs.
Operational check: ensure AP/controller management is restricted to a management VLAN/SSID or wired path; verify guest clients cannot open the AP admin URL; apply rate limits if design requires; confirm no admin credentials appear on festival signage or portal pages.