AP Cybersecurity Drill 10: Wireless Configuration Table

Question 1. Reading the table, which configuration most directly lets any customer reach the point-of-sale system?

• A) The staff network is the one that is protected using WPA2 encryption and a set password
• B) The staff network's password happens to be the weak and guessable value tovasco2019
• C) The guest network is open and is also allowed to reach the point-of-sale system directly ✓
• D) The staff and guest networks are both being broadcast out to the shop from one single shared wireless access point

Explanation: Choice C is correct. The guest network requires no password and is configured to reach the point-of-sale system, so any customer who joins it can attempt to reach that system directly. Choice A is incorrect. WPA2 on the staff network is a protection, not the path that exposes the point-of-sale system to guests. Choice B is incorrect. The staff password concerns staff access, not what the open guest network can reach. Choice D is incorrect. Sharing one access point is common; the exposure comes from the guest network being allowed to reach the point-of-sale system, not the shared hardware.

Question 2. Which change best stops guest devices from reaching the point-of-sale system and staff PCs?

• A) Isolate the guest network so it can reach the internet but not the staff network or point-of-sale system ✓
• B) Rename the guest network's SSID to something far less obvious so that customers are less likely to find it
• C) Lower the wireless access point's transmit power so that the guest signal does not reach as far in the shop
• D) Post a clear notice politely asking customers not to attempt to open or reach the point-of-sale system

Explanation: Choice A is correct. Network isolation that allows guest traffic to the internet but blocks it from the staff segment and point-of-sale system enforces the separation the administrator wants. Choice B is incorrect. Renaming the SSID hides nothing meaningful and does not restrict what the guest network can reach. Choice C is incorrect. Reducing transmit power shrinks coverage but does not prevent a connected guest from reaching the point-of-sale system. Choice D is incorrect. A request relies on customer behavior and does not technically block access.

Question 3. The guest network is open with no encryption. Which change most improves the confidentiality of what guests send over it?

• A) Hide the guest network's SSID so that the network does not appear in the list of available networks
• B) Set a deliberately shorter guest password so that staff can share it quickly and easily with customers
• C) Limit the guest network so that it allows only a single customer device to be connected at any one time
• D) Enable WPA3, or WPA2 if WPA3 is unavailable, and give guests the current password ✓

Explanation: Choice D is correct. Turning on WPA3, or WPA2 where WPA3 is unavailable, encrypts traffic between guest devices and the access point, improving confidentiality compared with an open network, though it is not a substitute for HTTPS; providing the password keeps it usable. Choice A is incorrect. Hiding the SSID does not encrypt traffic; an open hidden network is still unencrypted. Choice B is incorrect. A shorter password weakens protection and does not address the lack of encryption. Choice C is incorrect. A one-device limit does not encrypt anyone's traffic.

Question 4. Which entry in the table is the clearest sign that an attacker could take control of the wireless settings themselves?

• A) The staff network is being broadcast to the shop under the network name Tovasco-Staff
• B) The open guest network has been configured without requiring any password from users
• C) The router admin page still uses the publicly known factory-default login admin / admin ✓
• D) Both the staff network and the guest network are being run together from one single shared wireless access point

Explanation: Choice C is correct. A factory-default admin login such as admin / admin is publicly known, so anyone who reaches the admin page can log in and change every wireless setting, which is the clearest path to controlling the configuration. Choice A is incorrect. The staff SSID name is not a credential and does not grant control. Choice B is incorrect. The open guest network is a serious exposure for access to systems but does not by itself hand over the admin console. Choice D is incorrect. Using one access point is a normal design choice, not evidence of admin-level compromise.

Question 5. Considering the whole table, which set of changes best secures both networks?

• A) Keep all of the current settings as they are but tell staff to log out of the point-of-sale system nightly
• B) Replace the default admin login and weak staff password, encrypt the guest network, and isolate guests ✓
• C) Turn off the guest network entirely and instead simply give visiting customers the staff network password
• D) Change only the staff network password to a strong unique value and leave every other setting exactly as is

Explanation: Choice B is correct. Replacing the default admin login and the weak staff password with strong unique ones, encrypting the guest network, and isolating guests together fix the admin exposure, the easy-to-guess staff access, the open guest traffic, and the guest path to the point-of-sale system. Choice A is incorrect. Logging out at night leaves the default admin login, weak password, open guest network, and guest reachability untouched. Choice C is incorrect. Giving customers the staff password puts guests directly onto the sensitive network, the opposite of isolation. Choice D is incorrect. A stronger staff password helps, but it leaves the factory-default admin login, the open guest network, and the guest path to the point-of-sale system unaddressed.