A city council demo accidentally leaves a lab rogue SSID running overnight in the building. What lesson should the after-action note emphasize?
Select an answer to reveal the explanation.
Short Explanation
The demo ended. The fake AP did not. That is how you turn a teaching moment into an accidental evil twin for the night crew. Put someone's name on teardown before the applause.
Full Explanation
When a city council demo accidentally leaves a lab rogue SSID running overnight, the after-action lesson is that unattended rogue APs are hazardous and unprofessional and must be prevented with ownership, checklists, and verified teardown. Unattended rogues are not harmless after hours; clients still auto-join familiar names in municipal buildings. Overnight lab SSIDs do not automatically become WIPS sensors merely by neglect. RF jamming is not an acceptable cleanup method and is typically unlawful regardless of the demo audience. Exam caveat: demo environments in civic buildings still require production-grade change discipline because bystanders and staff devices share the RF environment with the lab radio. Operational check: assign teardown ownership before any demo, verify BSSID absence after the event, and add a dual-person confirmation step for council or public-facing wireless exercises. For municipal and campus engagements, keep the finding language tied to authorized scope, name the building or SSID class affected, and state the residual risk to residents or staff if the rejected option had been chosen. Re-validate after the next change window that the selected control still matches inventory, monitoring, and RoE abort criteria used by the city wireless program.