A city wants to keep push-button WPS available only when an admin is physically present. How should an OSWP-style assessment view that control?
Select an answer to reveal the explanation.
Short Explanation
Babysitting the WPS button is better than leaving it on 24/7—but the grown-up move is still off. If nobody needs WPS, kill the feature. Supervision is a compromise, not a force field.
Full Explanation
Operational controls such as enabling push-button WPS only under administrator supervision shrink the window of exposure compared with always-on WPS. They do not remove WPS as an attack surface class and do not equal certificate-based Enterprise auth. When WPS is not required for operations, full disablement is the preferred hardening. Assessments should describe residual risk honestly.