A county fair vendor AP broadcasts a mesh/backhaul SSID and a separate client SSID from the same radio. For an authorized assessment, what must the scope statement do first?
Select an answer to reveal the explanation.
Short Explanation
Picture one storefront with two doors: staff alley and customer entrance. Same building, different doors and rules. On Wi-Fi, one radio can hang multiple SSIDs with different jobs — so the engagement letter has to say which door you're allowed to knock on.
Full Explanation
A single physical AP can advertise multiple SSIDs and corresponding BSSIDs with different roles—client access versus mesh or backhaul being a common fairground pattern. Authorized assessment scope must name which SSID and role are in scope first, because techniques appropriate for a guest PSK SSID may be inappropriate or explicitly forbidden against a backhaul link. Sharing one radio does not automatically place every virtual BSS inside the engagement for a county fair vendor network. Treating every SSID on the radio as in-scope solely because they share hardware over-broadens testing without written approval and can interrupt critical vendor links. Ignoring named SSIDs and testing only the strongest BSSID on the channel skips role-based scoping. Assuming mesh or backhaul is automatically out of scope without documenting that decision still leaves an audit gap; exclusions should be explicit in the worksheet. Exam caveat: Multi-SSID APs are normal in civic events; always bind RoE to named SSID and BSSID pairs before any active technique. Operational check: Inventory all SSIDs and BSSIDs from the vendor AP, mark each in or out of scope with stakeholder sign-off, then proceed only against approved identities.