At a city special-event venue, recon shows access points still using vendor-default SSID naming patterns. What should the assessor conclude from that observation?
Select an answer to reveal the explanation.
Short Explanation
If the SSID still looks like it left the factory gift box, someone probably rushed the build. Flag it for inventory and hardening follow-up. Defaults are a clue about ops hygiene, not proof of a finished secure design.
Full Explanation
Vendor-default SSID naming patterns at a city special-event venue hint at weak administrative practices and help inventory unmanaged or hastily deployed devices. Defaults do not prove strong modern crypto by themselves; they are a reconnaissance signal that gear may still carry default credentials, open management, or incomplete hardening. Civic assessors escalate such findings into configuration review under RoE. Saying default SSIDs prove WPA3-SAE is negotiated and need no further review fails by concept: naming defaults say nothing reliable about AKM negotiation. Claiming default names mean networks are out of scope because vendors own them fails by concept: the city or event operator typically owns the deployed devices despite vendor-ish names. Asserting default SSID patterns encrypt management frames so recon cannot see BSSIDs fails by concept: default names do not hide BSSIDs from survey tools. Exam caveat: confirm ownership—some default-looking SSIDs may be attendee hotspots not under the venue contract; do not test them without scope confirmation. Operational check: list default-pattern SSIDs, match BSSIDs to event inventory where possible, flag unmanaged candidates for the venue WLAN owner, and schedule authorized hardening validation rather than assuming crypto strength from the name.