A city SOC detects an unauthorized AP in a lobby. For OSWP-style literacy, how should detection work be framed relative to offensive rogue-AP study?
Select an answer to reveal the explanation.
Short Explanation
Blue team spots the lobby impostor with inventories and WIPS; red/purple team studies how that impostor works only with a signed hall pass. Detection and offense are different jobs sharing the same vocabulary—authorization still draws the line. Do not skip RoE just because the SSID looks weird, and never dump secrets on social media.
Full Explanation
When a city SOC detects an unauthorized AP in a lobby, defensive work uses inventory or WIPS to find rogues, while offensive study of how rogues work still needs clear authorization framing. OSWP-style literacy separates detection duty from unauthorized offensive practice. Civic teams can learn both sides without collapsing into illegal hacking narratives.
'Detection is illegal; only unauthorized attackers may study rogue APs' fails because detection is not illegal, and studying rogue APs offensively still requires authorization. 'Offense requires no authorization if the SSID string looks misspelled' fails because a misspelled SSID does not remove the need for authorization to run offense. 'Once detected, staff must immediately publish the rogue's PSK on social media' fails because staff must not publish a rogue's PSK on social media once detected.
Exam caveat: finding a rogue is an incident—handle evidence and public communications through policy. Operational check: maintain municipal BSSID inventories, alert on unknowns, investigate with approved procedures, and only conduct offensive twin tests under separate written RoE. Escalate lobby rogues to incident response with chain-of-custody notes. In municipal wireless operations, record the rationale in the engagement notes so future assessors know which control or technique class was chosen and which failure modes the rejected options would create for city services.