Independent contractors often work from a business ' s lobby.

Open Ethernet ports in a public-facing area create a direct, high-trust entry point into the internal network. The most efficient fix is to remove that exposure by disabling the lobby ports and moving untrusted users to a segmented guest network. Quentin Docter explains why disabling unused/unauthorized access points matters: “Ports on a switch, router, or firewall not in use present an open door for an attacker to enter and should be disabled or disconnected.” That directly supports disabling lobby switch ports that shouldn’t be available to external users.

He also describes guest network isolation: guests “never need to connect to the organization’s servers and internal systems,” so a guest SSID should be created that “isolates guest traffic from production traffic.” This is exactly what option B accomplishes: it prevents contractors from gaining internal wired access while still providing Internet access through a controlled guest network.

WPA3 (A) only improves Wi-Fi encryption; it doesn’t stop wired port access. Monitoring traffic (C) is reactive. Signage (D) is weak administrative control compared to disabling the ports.