A clinic IoT SSID uses the device serial number printed on the badge as its WPA2-PSK. How should an assessor classify that choice?
Select an answer to reveal the explanation.
Short Explanation
If the password is etched on the gadget for anyone walking by, it is not a secret—it is a name tag. Serial-as-PSK fails entropy because recon can read it. Treat that as discoverable credential failure, not clever provisioning.
Full Explanation
When a clinic IoT SSID uses a device serial number printed on a badge as its WPA2-PSK, the assessor should treat that secret as effectively discoverable to nearby attackers who can read or photograph the label and then attempt offline recovery against captured handshake material. Public or semi-public identifiers are not high-entropy secrets. Municipal and healthcare IoT networks that print the key on the device collapse physical observation into credential exposure.
'Serial-based PSKs provide maximum entropy because serials are globally unique forever.' fails because serial-based PSKs do not provide maximum entropy merely because serials look unique. 'Serial numbers are acceptable PSKs only when the SSID name is hidden.' fails because hiding the SSID does not make printed serials acceptable high-entropy passphrases. 'Using serials forces attackers into Enterprise PEAP cracking instead of Personal mode.' fails because using serials does not force attackers into Enterprise PEAP cracking instead of Personal offline testing.
Exam caveat: discoverable PSKs are a policy and provisioning finding even before any cracker finishes. Operational check: during the civic clinic walkthrough, note whether PSKs appear on labels or asset tags, attempt offline recovery only under authorization against that SSID, and recommend random unique secrets or Enterprise onboarding. Photograph label-exposure evidence for the authorized report audience only. In municipal wireless operations, record the rationale in the engagement notes so future assessors know which control or technique class was chosen and which failure modes the rejected options would create for city services.