A wastewater plant moves public Wi-Fi users into a dedicated VLAN isolated from finance servers. What is the primary purpose of that VLAN segmentation?
Select an answer to reveal the explanation.
Short Explanation
Guests get their own swimming lane so they are not cannonballing into finance. A dedicated VLAN separates untrusted Wi-Fi users from internal servers at Layer 2. It is segmentation—not encryption and not a free OSPF ticket into the money VLAN.
Full Explanation
Placing public Wi-Fi users into a dedicated VLAN at the wastewater plant primarily separates untrusted guest traffic from sensitive internal systems at Layer 2 by giving guests their own broadcast domain apart from finance servers. That segmentation limits casual Layer 2 reachability, shrinks ARP/broadcast exposure into internal segments, and creates a clean attachment point for Layer 3 policy (ACLs, firewalls, captive portals). VLANs are not encryption and do not replace higher-layer controls, but they are the foundational municipal tool for keeping guest airtime off the finance LAN. Isolation of the L2 domain is the purpose named in the stem. Guaranteeing guests the same OSPF default route as finance servers aims at shared routing fate, which undermines isolation rather than explaining segmentation’s purpose. Forcing guest frames onto the STP root port regardless of VLAN misunderstands STP topology control and does not define guest VLAN purpose. Claiming VLANs replace firewall policies because they encrypt payload data is doubly wrong: VLANs do not encrypt user payloads and do not obsolete firewalls. Exam caveat: VLAN segmentation is necessary but not sufficient—expect exam language that still pairs guests with filtering at Layer 3/security devices. Operational check: confirm guest SSIDs map only to the guest VLAN, verify finance servers are absent from that VLAN, test that guest clients cannot ARP/direct-L2 to finance, and validate firewall/ACL rules on the guest SVI or next-hop enforce internet-only or portal policy.