A CISO asks for the simplest correct upgrade path from café-style WPA2-PSK city Wi-Fi to something safer for staff. What direction should the assessor recommend?
Select an answer to reveal the explanation.
Short Explanation
Staff should not share the café pitcher password with every visitor. Give employees badge-based Enterprise 802.1X, and park guests on their own onboarded PSK or OWE SSID. Separate doors beat one sticky note for the whole city hall.
Full Explanation
The simplest correct upgrade direction from café-style WPA2-PSK city Wi-Fi for staff is to move staff onto Enterprise 802.1X for per-user authentication and revocation, while keeping guests on separately onboarded PSK or OWE designs. That separation improves accountability without forcing guests into directory accounts. Assessors should recommend identity-bound staff access rather than whiteboard PSK rituals or encryption disablement. Moving staff onto the same guest PSK rotated on a whiteboard preserves shared-secret failure modes. Disabling encryption on staff SSIDs and requiring VPN-only confidentiality drops link-layer protections inappropriately. Enabling WEP shared-key on staff SSIDs for scanner speed reintroduces broken crypto. Exam caveat: Enterprise migrations need RADIUS, certificates, and client provisioning—budget those operational pieces. Operational check: Stand up a pilot staff Enterprise SSID, migrate a cohort, confirm individual disable works, and leave guests on a distinct onboarding model. In civic WLAN stewardship, keep authorization boundaries explicit, prefer the least disruptive technique class allowed by RoE, and record BSSID, channel, band, and security mode beside every conclusion so another assessor can reproduce the observation.