Best Wi-Fi Security for a Public Coffee Shop
Short answer
D Implement WPA2 or WPA3 encryption on the coffee shop access point, giving customers encrypted air-interface protection with a single shared passphrase and no per-device management overhead.
Question
Key Takeaways
The question tests which wireless security control balances real protection against ease of management for non-technical staff — the trap is choosing security-by-obscurity or per-client controls that break supportability.
For a small coffee shop offering free customer Wi-Fi, WPA2 or WPA3 encryption is the most suitable security measure because it protects traffic with minimal configuration and no per-user setup. The page explains why SSID hiding, MAC filtering, and mandatory VPNs fail the owners' simplicity and manageability requirements.
Common mistake: Option B (MAC address filtering) is the most tempting wrong pick because it sounds restrictive, but MAC addresses are trivially spoofed and every new customer device must be manually registered, which is unmanageable for a coffee shop.
Expert Analysis
Why the Answer Is Correct
WPA2 (AES-CCMP) or WPA3 (SAE/192-bit suite) encryption is the only option here that actually encrypts the air interface, so customer traffic is not readable by a passive attacker with a wireless sniffer. It is also the simplest to operate: staff set one passphrase on the access point (or hand out a captive-portal key), and there is no per-device provisioning, which directly satisfies the owners' requirement for a solution that 'would not require a lot of technical knowledge to manage.' WPA3 additionally removes the offline dictionary attack against the four-way handshake that still weakens WPA2-PSK, making it the strongest choice when the AP and client fleet support it. Because a coffee shop's threat model is dominated by on-air snooping and evil-tunnel attacks from the parking lot, encrypting the WLAN is the correct first and highest-value control.
Why the Other Options Are Wrong
Option A (disabling SSID broadcast) is security by obscurity: the SSID is still transmitted inside probe requests and beacon-derived management frames, and tools recover it passively within seconds; it also makes the shop's own customers unable to find the network. Option B (MAC address filtering) offers no real protection because MAC addresses are unauthenticated and freely spoofed, and it forces the staff to register every patron's device, which is operationally impossible for a high-turnover venue. Option C (requiring a customer VPN) shifts a burdensome, technically demanding task onto every guest, so most customers simply will not connect, and it protects only the tunnel endpoint rather than the shared L2 segment or the shop's own point-of-sale traffic.
Community Comment Notes
The community vote is unanimous at 100% for D, and the reasoning given matches the analysis above: one voter emphasised 'ease of use and limited technical capabilities - D'. Another voter simply re-stated the option, 'D. Implement WPA2 or WPA3 encryption', and a removed comment asked the team to 'double-check this response', but no substantive objection to D was raised. On independent review of the wireless-security literature the consensus is correct, so D stands as the verified answer.
Official Reference
https://www.wi-fi.org/discover-wi-fi/security
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a question adds constraints like 'simple', 'not a lot of technical knowledge to manage', or 'free public access', pick the control that scales without per-user administration — strong link-layer encryption beats obscurity or per-device lists. Treat SSID hiding and MAC filtering as distractors: on the CEH exam they are classic weak controls that always lose to WPA2/WPA3.
Frequently Asked Questions
Why is MAC address filtering a bad choice for a coffee shop Wi-Fi network?
Does hiding the SSID broadcast make the coffee shop network secure?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
insaniunt 👍 3 Answered DD. Implement WPA2 or WPA3 encryption
-
LordXander 👍 1 Answered DAgain, ease of use and limited technical capabilities - D
-
[Removed] 👍 1Hey team can we double-check this response
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.