A county asks for the simplest remediation when WPS is enabled on APs but is not required for onboarding. What should be recommended?
Select an answer to reveal the explanation.
Short Explanation
If nobody needs the easy button, turn WPS off—on the AP or the controller. Renaming the SSID or posting the PIN is theater. Dragging guests back to WEP makes things worse.
Full Explanation
The durable municipal remediation for unnecessary WPS exposure is to disable WPS on the access points or controllers wherever onboarding does not need it. Renaming SSIDs, publishing PINs, or downgrading encryption are not substitutes. Civic security baselines should make WPS-off the default for staff and IoT SSIDs.
'Leave WPS on but rename the SSID daily so PIN attacks cannot find the BSS' fails because leaving WPS on while renaming the SSID daily does not stop PIN attack classes from finding a BSS that still offers WPS. 'Publish the WPS PIN on a public intranet wiki so staff stop calling the help desk' fails because publishing the WPS PIN on a public intranet wiki increases exposure instead of reducing help-desk calls safely. 'Switch all guest traffic to WEP so WPS becomes irrelevant' fails because switching guest traffic to WEP to make WPS irrelevant is a severe downgrade, not remediation.
Exam caveat: disable means all relevant radios/SSIDs—partial disable leaves a live surface. Operational check: push WPS disable via controller templates, verify with wash scans on 2.4 and 5 GHz, and confirm help-desk onboarding uses approved alternatives. Track exceptions with expiry dates in the municipal risk register. In municipal wireless operations, record the rationale in the engagement notes so future assessors know which control or technique class was chosen and which failure modes the rejected options would create for city services.