A hospital wing uses a hidden staff SSID that suppresses the name in beacons. How can authorized recon still discover it?
Select an answer to reveal the explanation.
Short Explanation
“Hidden” mostly means the beacon is shy—clients still probe and associate, and those frames often spill the name. Beacon blanking is not an invisibility cloak.
Full Explanation
Hidden staff SSIDs that suppress the name in beacons are still discoverable during authorized hospital recon because probe requests, probe responses, and association activity from clients often reveal the ESSID despite beacon suppression. Hiding is obscurity, not cryptography. Civic assessors watch client behavior on the channel under RoE to learn the suppressed name without needing mythical master passwords. Saying hidden SSIDs are cryptographically impossible to observe without the WPA3 master password fails by concept: SSID hiding is not encryption of the name against all observation, and WPA3 passwords are unrelated to beacon suppression mechanics. Claiming only SNMP polling of neighboring cafés can disclose the hospital ESSID fails by concept: discovery is local RF client activity, not café SNMP. Asserting hiding permanently removes all 802.11 management frames fails by concept: beacons may omit the SSID field while other management frames continue. Exam caveat: hospital environments are sensitive—even authorized recon should minimize dwell and follow healthcare RoE and privacy constraints when logging probe contents. Operational check: passively monitor the wing’s channels for probe/association frames revealing the hidden SSID, confirm against the hospital WLAN inventory, and avoid active probing unless RoE phase two explicitly allows it.