Best Wi-Fi Security for a Public Coffee Shop
As an IT intern, you have been asked to help set up a secure Wi-Fi network for a local coffee shop. The owners want to provide free Wi-Fi to their customers, but they are concerned about potential security risks. They are looking for a simple yet effective solution that would not require a lot of technical knowledge to manage. Which of the following security measures would be the most suitable in this context?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests which wireless security control balances real protection against ease of management for non-technical staff — the trap is choosing security-by-obscurity or per-client controls that break supportability.
For a small coffee shop offering free customer Wi-Fi, WPA2 or WPA3 encryption is the most suitable security measure because it protects traffic with minimal configuration and no per-user setup. The page explains why SSID hiding, MAC filtering, and mandatory VPNs fail the owners' simplicity and manageability requirements.
Option B (MAC address filtering) is the most tempting wrong pick because it sounds restrictive, but MAC addresses are trivially spoofed and every new customer device must be manually registered, which is unmanageable for a coffee shop.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
WPA2 (AES-CCMP) or WPA3 (SAE/192-bit suite) encryption is the only option here that actually encrypts the air interface, so customer traffic is not readable by a passive attacker with a wireless sniffer. It is also the simplest to operate: staff set one passphrase on the access point (or hand out a captive-portal key), and there is no per-device provisioning, which directly satisfies the owners' requirement for a solution that 'would not require a lot of technical knowledge to manage.' WPA3 additionally removes the offline dictionary attack against the four-way handshake that still weakens WPA2-PSK, making it the strongest choice when the AP and client fleet support it. Because a coffee shop's threat model is dominated by on-air snooping and evil-tunnel attacks from the parking lot, encrypting the WLAN is the correct first and highest-value control.Why the Other Options Are Wrong
Option A (disabling SSID broadcast) is security by obscurity: the SSID is still transmitted inside probe requests and beacon-derived management frames, and tools recover it passively within seconds; it also makes the shop's own customers unable to find the network. Option B (MAC address filtering) offers no real protection because MAC addresses are unauthenticated and freely spoofed, and it forces the staff to register every patron's device, which is operationally impossible for a high-turnover venue. Option C (requiring a customer VPN) shifts a burdensome, technically demanding task onto every guest, so most customers simply will not connect, and it protects only the tunnel endpoint rather than the shared L2 segment or the shop's own point-of-sale traffic.Community Comment Notes
The community vote is unanimous at 100% for D, and the reasoning given matches the analysis above: one voter emphasised 'ease of use and limited technical capabilities - D'. Another voter simply re-stated the option, 'D. Implement WPA2 or WPA3 encryption', and a removed comment asked the team to 'double-check this response', but no substantive objection to D was raised. On independent review of the wireless-security literature the consensus is correct, so D stands as the verified answer.Official Reference
Exam Strategy
When a question adds constraints like 'simple', 'not a lot of technical knowledge to manage', or 'free public access', pick the control that scales without per-user administration — strong link-layer encryption beats obscurity or per-device lists. Treat SSID hiding and MAC filtering as distractors: on the CEH exam they are classic weak controls that always lose to WPA2/WPA3.
Frequently Asked Questions
Why is MAC address filtering a bad choice for a coffee shop Wi-Fi network?
MAC addresses travel in cleartext and can be spoofed in seconds with common tools, so filtering stops no real attacker while forcing staff to register every guest device — unmanageable for a high-turnover venue.
Does hiding the SSID broadcast make the coffee shop network secure?
No. The SSID is still visible in probe requests and management frames, so it is recovered passively in seconds; hiding it only complicates connection for legitimate customers.