A mayor asks a consultant to “quickly test the courthouse Wi-Fi” with no written authorization from the system owner. What should the consultant do?
Select an answer to reveal the explanation.
Short Explanation
A friendly mayoral nudge is not a signed ticket to jam the courthouse air. RF attacks need explicit owner authorization—full stop. Verbal enthusiasm does not replace RoE.
Full Explanation
If a mayor asks a consultant to quickly test the courthouse Wi-Fi with no written authorization from the system owner, the consultant must refuse until explicit written authorization from the system owner is in place; informal requests are insufficient for RF attacks. Beginning passive scans immediately because elected officials verbally outrank RoE paperwork is unprofessional and legally risky. Limiting testing to deauth only does not remove the need for approval in municipal buildings. Publishing cracked keys to a public paste site is a confidentiality failure, not faster delivery. Exam caveat: authorization must identify scope, techniques, windows, and abort criteria—even for high-visibility civic requesters. Operational check: pause, request written RoE from the courthouse system owner or designated authority, and decline RF work until that document exists and is understood by both parties. For municipal and campus engagements, keep the finding language tied to authorized scope, name the building or SSID class affected, and state the residual risk to residents or staff if the rejected option had been chosen. Re-validate after the next change window that the selected control still matches inventory, monitoring, and RoE abort criteria used by the city wireless program.