A municipal RF policy asks when VPN-over-Wi-Fi is still relevant for city staff. What guidance fits an OSWP-style encryption assessment?
Select an answer to reveal the explanation.
Short Explanation
A VPN is a sealed briefcase you carry across a sketchy café table—it helps on open or untrusted Wi-Fi. It is not permission to leave the city's own WLAN unlocked. Design the air right first, then add VPN where the path is still hostile.
Full Explanation
VPN-over-Wi-Fi can add transport protection for city staff on untrusted or open networks, covering gaps when link-layer encryption is absent or untrusted. It does not replace proper WLAN encryption design for municipal SSIDs staff join daily: WPA2/WPA3 still reduce local eavesdropping, misbinding, and some metadata exposures VPNs do not fully erase. OSWP-style assessment guidance keeps VPN as layered defense, not as an excuse for weak Wi-Fi. Saying VPN fully replaces WPA2/WPA3 design whenever staff roam across buildings oversells overlay tunnels. Claiming VPN is obsolete once any RSN pairwise cipher appears ignores open guest and misconfiguration cases. Asserting VPN is required by 802.11 before Open System authentication can complete invents a standard mandate. Exam caveat: Evaluate WLAN mode and VPN as complementary controls in findings. Operational check: On an open lab SSID, compare cleartext app leakage with and without staff VPN under authorization, then still recommend fixing the WLAN encryption baseline. In civic WLAN stewardship, keep authorization boundaries explicit, prefer the least disruptive technique class allowed by RoE, and record BSSID, channel, band, and security mode beside every conclusion so another assessor can reproduce the observation.