A municipal CISO asks what passive listening on Wi-Fi can typically observe without associating to the network. Which answer is most accurate?
Select an answer to reveal the explanation.
Short Explanation
Standing outside a shop, you can still read the neon sign and watch people knock on the door — you don't need to walk inside. Passive Wi-Fi listening is like that: beacons and probes leak a lot of management gossip before you ever associate.
Full Explanation
Passive listening in monitor mode can typically observe beacons, probe activity, and other unprotected or lightly protected management information without associating to the municipal network or obtaining an IP address. That visibility supports inventory, security-mode classification, and client activity awareness under RoE even when data payloads remain encrypted or absent. CISOs should understand passive recon value without confusing it with full decryption of user content on city Wi-Fi. Claiming only encrypted data payloads after a full 4-way handshake are visible understates management-frame intelligence available before joining. Saying nothing useful appears until DHCP assigns an IP wrongly requires association and addressing first. Asserting visibility only from clients that already trust the assessor’s certificate imports an Enterprise TLS trust model into basic passive RF listening. Exam caveat: Passive does not mean collect everything forever; minimize retention and stay inside geographic and technology scope written in RoE. Operational check: With association disabled, confirm beacons and probes for in-scope BSSIDs are visible on the correct channel and that the worksheet records security modes from those advertisements alone.