Which statement best describes the requirement for methods used to test for the presence of wireless access points?

Which statement best describes the requirement for methods used to test for the presence of wireless access points?

• A. Only external scanning is required.
• B. Any methods used must be sufficient to detect and identify both authorized and unauthorized wireless devices.
• C. NAC must be used exclusively.
• D. Scans are optional if authorizations exist.

Answer: (B)

The main idea is that testing for wireless access points should uncover every wireless device present, not just a subset. The best choice says that any methods used must be sufficient to detect and identify both authorized and unauthorized wireless devices. That ensures you can spot rogue or misconfigured access points that could expose cardholder data or bypass controls. Relying only on external scanning misses devices inside the building or behind barriers, so internal visibility is also needed. Relying on NAC alone isn’t appropriate because NAC addresses access control rather than providing a complete survey of all wireless devices. Scans being optional if you have authorizations ignores the need for ongoing verification and continuous monitoring. The goal is to have detection methods capable of finding every wireless device in the environment so you can manage risk effectively.

The main idea is that testing for wireless access points should uncover every wireless device present, not just a subset. The best choice says that any methods used must be sufficient to detect and identify both authorized and unauthorized wireless devices. That ensures you can spot rogue or misconfigured access points that could expose cardholder data or bypass controls. Relying only on external scanning misses devices inside the building or behind barriers, so internal visibility is also needed. Relying on NAC alone isn’t appropriate because NAC addresses access control rather than providing a complete survey of all wireless devices. Scans being optional if you have authorizations ignores the need for ongoing verification and continuous monitoring. The goal is to have detection methods capable of finding every wireless device in the environment so you can manage risk effectively.