During a parks department WLAN assessment, the team notes manufacturer OUIs derived from BSSIDs. What is the most accurate use of that observation?
Select an answer to reveal the explanation.
Short Explanation
An OUI is a name tag on the radio, not a hole in the fence. It helps the parks inventory guess which vendor built the AP. It does not mean the device is broken or in-scope for attack on that fact alone.
Full Explanation
Manufacturer OUIs derived from BSSIDs during a parks department assessment are inventory hints about likely AP vendors. They help civic teams recognize fleet brands and sometimes spot unexpected devices, but an OUI is not itself a vulnerability and does not authorize attacks or prove passphrase weakness. Accurate use stops at enrichment of the asset picture. Treating every recognizable OUI as an exploitable vulnerability to attack immediately fails by concept: vendor identity ≠ exploitability. Using OUI as a substitute for confirming SSID ownership and RoE scope fails by concept: many organizations use the same vendors; OUI does not prove ownership. Assuming OUI fingerprints reveal the PSK and skipping handshake collection fails by concept: OUIs do not encode passphrases. Exam caveat: locally administered or randomized MACs can obscure OUIs—do not over-trust a single prefix when building the municipal inventory. Operational check: map BSSID OUIs to vendor guesses, compare against the parks WLAN bill of materials, flag unknown vendors for ownership confirmation, and proceed to scoped testing only on authorized BSSIDs. In civic practice, write the decision and the verification command into the engagement notes so another assessor can repeat the check on the next shift without rediscovering the same pitfall under time pressure.