A port authority must keep police records and public Wi-Fi on separate broadcast domains in the same closet, then carry both upstream. Which design choice correctly achieves that separation?
Select an answer to reveal the explanation.
Short Explanation
Broadcast domains are like separate waiting rooms in one building. Different VLANs give each crowd its own room; an 802.1Q trunk is the hallway that carries both upstairs without mixing the crowds. Same VLAN with fancy DHCP still shares the same noisy room.
Full Explanation
VLANs partition Layer-2 broadcast domains so police records traffic and public Wi-Fi do not share floods, ARP, or accidental bridging inside the same port-authority closet. Assign each service its own VLAN, map access ports correctly, and carry both tags upstream on an 802.1Q trunk between access and distribution. That design keeps broadcast domains distinct while still using shared physical uplinks—the standard civic pattern for multi-service closets.
Placing both services in VLAN 1 and relying on private IP addressing alone does not create Layer-2 isolation; RFC1918 addresses in one broadcast domain still see each other’s ARP and broadcasts. Bridging the two networks at Layer 2 and filtering only with port ACLs on the uplink leaves a shared L2 domain and depends on fragile ACL completeness for separation that VLANs provide structurally. Using a single access VLAN and separating only with different DHCP scopes likewise shares one broadcast domain—DHCP policy is not a substitute for VLAN segmentation.
Exam caveat: VLANs provide L2 separation, not a complete zero-trust story; still apply ACLs, firewalling, and authentication at appropriate layers, and never leave sensitive VLANs on trunks that should not carry them. Operational check: verify police and Wi-Fi ports are in distinct VLANs, confirm the uplink trunk allows both tags, capture or SPAN to ensure broadcasts do not cross, and validate inter-VLAN routing policy only where intentional.