A city clerk needs a device that forwards packets between the permits VLAN and the Internet edge so online applications can reach public systems. Which device best fills that role?

Traffic that must leave the permits VLAN and reach public systems at the Internet edge needs Layer 3 forwarding between distinct networks. A router examines destination IP addresses, consults a routing table, and forwards packets from the permits subnet toward the edge path serving online applications. That is the role the city clerk needs: without a router to route between the permits VLAN and external networks, citizen-facing application traffic cannot leave its local network. The unmanaged Layer 2 switch fails by concept because it forwards frames within the permits VLAN but does not route IP packets between that VLAN and the Internet edge. The wireless access point associates 802.11 clients on a single SSID and provides wireless attachment; that does not perform the required inter-network routing. The PoE injector supplies power to IP phones and cameras, which is unrelated to forwarding packets between networks. Exam caveat: Do not confuse local connectivity with routing. A switch or access point can provide local connectivity without providing a path between networks; the listed unmanaged Layer 2 switch is not a router. Practical check: From a host in the permits VLAN, verify that its default gateway is the router interface on that subnet, confirm the router has a route or default route toward the Internet edge, and test reachability to the public systems used by the online applications. If local ARP works but off-subnet destinations fail, the issue is routing, not a need for more Layer 2 ports.