A city help desk confuses 802.11 authentication with typing a username into a captive portal. How should the distinction be framed?
Select an answer to reveal the explanation.
Short Explanation
Joining the Wi-Fi is like plugging into the wall outlet; the captive portal is the front-desk form after the lights are already on. Different layers, different jobs.
Full Explanation
802.11 authentication and association are link-layer procedures that establish membership in a BSS. A captive-portal username/password prompt is a higher-layer access gate that typically appears only after the client already has Layer-2 connectivity (often on an open or similarly permissive SSID) and attempts HTTP/HTTPS navigation. City help desks should separate “joined the Wi-Fi radio network” from “accepted the portal terms / logged in for Internet policy.” Calling captive-portal login the only IEEE 802.11 management frame type is incorrect; portals are not an 802.11 management subtype. Claiming 802.11 authentication always means RADIUS EAP-TLS before association on open SSIDs conflates Enterprise 802.1X with the lightweight Open System Authentication used on many open networks. Saying a splash page means association has not completed usually has it backward: portals generally require association first. Exam caveat: For OSWP attack-surface thinking, open+portal is a different class from WPA2-PSK or Enterprise; keep the layering straight. Operational check: On an authorized guest SSID, verify association completes and the client receives local connectivity before the portal intercept; document both stages in the finding notes.