An assessor sees TLS alerts during EAP on a city Enterprise SSID. How should those clues be interpreted under rules of engagement?
Select an answer to reveal the explanation.
Short Explanation
TLS alerts in EAP are yellow flags: maybe the laptop trusts the wrong CA, maybe something is intermediating. Investigate under RoE—do not jump to PMK paste sites or open-SSID conclusions.
Full Explanation
TLS alerts during EAP on a city Enterprise SSID should be interpreted as signals that may indicate wrong trust settings or active interception, and they warrant careful investigation under RoE rather than dramatic assumptions. TLS alerts do not always prove the pairwise master key was posted to a public paste site. They do not mean the SSID has fallen back to open authentication for all clients. They do not confirm that WPS PIN lockout is the only remaining defense. Exam caveat: correlate alerts with client trust stores, known-good AAA certificates, and whether an authorized twin or mis-issued cert is in play before writing a critical finding. Operational check: reproduce with a known-good civic laptop, compare certificate chain to documentation, and escalate only with evidence that distinguishes user misconfiguration from active malicious interception. For municipal and campus engagements, keep the finding language tied to authorized scope, name the building or SSID class affected, and state the residual risk to residents or staff if the rejected option had been chosen. Re-validate after the next change window that the selected control still matches inventory, monitoring, and RoE abort criteria used by the city wireless program.