A county asks whether Protected Management Frames (PMF) alone stop all evil-twin risks. What limitation is most accurate?
Select an answer to reveal the explanation.
Short Explanation
PMF toughens management frames on a given BSS—it does not glue users' hands so they never join the fake AP across the lobby. A separate rogue BSS is still a separate door. PMF is not an SSID vacuum, an open-network ban, or a full substitute for training and inventories.
Full Explanation
Protected Management Frames help against forged management frames on a BSS; they do not stop users joining a separate rogue BSS. Municipal stakeholders who expect PMF alone to end evil-twin risk overestimate the control. PMF is valuable, but association choices to lookalike networks remain a human and inventory problem.
'PMF deletes every lookalike SSID from the RF environment automatically' fails because PMF does not delete every lookalike SSID from the RF environment automatically. 'PMF forces all clients to ignore open networks forever' fails because PMF does not force all clients to ignore open networks forever. 'PMF replaces the need for user training and BSSID inventories' fails because PMF does not replace user training and BSSID inventories.
Exam caveat: PMF ≠ rogue-AP immunity—state the scope of protection accurately. Operational check: enable PMF where clients support it on civic SSIDs, continue twin monitoring and awareness, and test that staff still verify networks before joining. Document PMF as one layer in the municipal wireless control stack. In municipal wireless operations, record the rationale in the engagement notes so future assessors know which control or technique class was chosen and which failure modes the rejected options would create for city services.