Hospital Survey Validation and a Shared-PSK Clinical SSID
A 200-bed hospital asks for a WLAN validation. Design targets are -67 dBm primary, -72 dBm secondary, and SNR of at least 25 dB on 5 GHz for clinical devices; 2.4 GHz is only for guest and legacy clients. The survey report lists 62 APs and shows a nurses' station at -68 dBm with a noise floor of -80 dBm; the surveyor says "SNR looks fine for data." The survey was passive, performed with the survey AP transmitting 5 dB below production power and with 20 MHz channels, while production will use 40 MHz. The clinical SSID uses WPA2-PSK with one shared password for 400 staff, and the guest SSID is open with a captive portal on the same VLAN as clinical traffic. The CIO wants to know if the design is ready to build.
1. Evaluate the survey results against the design targets. Is the nurses' station compliant, and is the survey method trustworthy?
Read the worked answer
No, the nurses' station fails on two counts. The RSSI is -68 dBm, which misses the -67 dBm primary target (it only meets the secondary -72 dBm target). The SNR is -68 - (-80) = 12 dB, far below the 25 dB requirement. A 12 dB SNR supports low-order modulation and will produce retries and poor voice/video quality even though the signal "looks fine" on a coverage map.
The method is also not trustworthy. A passive survey at 5 dB below production power understates coverage and overstates cell separation; when production runs 5 dB hotter, co-channel interference rises and roaming cells overlap more. Surveying at 20 MHz while deploying 40 MHz shifts the noise floor by about 3 dB and changes the interference picture entirely. The report cannot be used to approve the build.
Re-survey at production power, channel width, and antenna settings, using an active survey with the actual clinical device types, and report RSSI, SNR, and secondary coverage per area. Then re-check the nurses' station and any area near the -67 dBm boundary.
2. Recommend security changes for the clinical and guest SSIDs, and state what must be re-verified before go-live.
Read the worked answer
A single PSK shared by 400 staff is not acceptable for clinical traffic: it cannot be revoked per person, gives no per-user accounting, and is easily leaked. Replace it with WPA2-Enterprise (or WPA3-Enterprise where devices support it) using 802.1X and EAP-TLS with per-device certificates, or at minimum unique user credentials. Put clinical, guest, and management traffic on separate VLANs with firewall rules between them; the guest network must never share a VLAN with clinical devices. Add client isolation on guest, keep the captive portal on its own VLAN, enable Protected Management Frames where supported, disable WPS, and restrict management access to the wired management VLAN. Add rogue AP and wireless intrusion monitoring.
Before go-live, verify: a test device authenticates and gets the correct VLAN and address per SSID; guest clients are isolated from clinical subnets; 802.1X roaming works with fast roaming enabled; certificates are deployed before the first shift; and coverage/SNR still meet target with security overhead and production power. Document the re-survey and the authentication test results.