GSEC Wireless Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Broadcast the corporate SSID with WPA3-SAE and give customers a rotating guest passphrase that changes weekly.

  Why it's wrong here

  Sharing a rotating passphrase still exposes a credential that guests can retain or share, and SAE passphrases on the corporate SSID place guests on the same logical network as internal devices unless further segmentation exists. The requirement to avoid sharing the corporate preshared key is only partially met, and isolation from point-of-sale systems is not guaranteed by the passphrase rotation alone.

• ✗

  Deploy the guest network on the same SSID as corporate users and rely on 802.1X to assign guests a restricted role after authentication.

  Why it's wrong here

  Customers generally lack the credentials needed for 802.1X, so this design blocks the guest use case. Placing guests and corporate devices on one SSID also increases the chance of misconfiguration that grants broader access than intended. While dynamic authorization can assign roles, requiring enterprise authentication for retail guests is operationally impractical and does not meet the stated requirement.

• ✗

  Enable a hidden guest SSID using WEP with a shared key so customers can connect without configuration changes.

  Why it's wrong here

  WEP is cryptographically broken and trivially cracked, so it provides no meaningful protection. Hiding the SSID offers no security benefit because the SSID is still discoverable in probe and association frames. This option also does nothing to isolate guest traffic from point-of-sale systems, and it would expose customer traffic to interception, making it unsuitable for any production guest network.

• ✓

  Configure a separate guest SSID mapped to a dedicated VLAN with client isolation enabled and no route to internal subnets.

  Why this is correct

  A distinct guest SSID bound to its own VLAN keeps guest traffic on a segmented broadcast domain, and client isolation prevents guests from reaching each other. With no routing or ACL permitting access to internal subnets, point-of-sale systems stay unreachable. This satisfies open or captive-portal guest access without distributing the corporate preshared key, which remains protected for internal users.