A small municipal annex AP still has encryption marked optional/legacy, and some IoT printers associate in inconsistent insecure ways. Design requires modern cipher required. What should the technician do?
Select an answer to reveal the explanation.
Short Explanation
"Optional" legacy encryption is a fail-open mess—devices may connect without the modern protection the city wants. Set the AP to require the approved modern cipher. Client isolation is not a stand-in for fixing encryption config.
Full Explanation
A small municipal annex AP that still has encryption marked optional/legacy, with some IoT printers associating in inconsistent insecure ways while design requires modern cipher required, should have the AP encryption configuration corrected to require the approved modern cipher suite rather than optional legacy settings. Optional/legacy modes permit weak associations that fail audits and policy. Technicians enforce required AES-class settings from the design doc.
Leaving encryption optional so any device can fail open and still pass a security audit fails the audit and the design. Disabling all SSIDs and running only wired Ethernet for printers regardless of the WLAN design doc fails by abandoning the written WLAN design without authority. Setting client isolation off globally as a substitute for requiring modern encryption fails by concept: isolation is not encryption.
Exam caveat: “encryption optional” is an incorrect AP security configuration relative to modern required suites.
Operational check: set the annex SSID to require WPA2/WPA3 with AES/CCMP per design; disable optional legacy ciphers; retest printers; quarantine devices that cannot meet policy onto a controlled exception path.