A museum runs guest and staff SSIDs on the same APs but needs different WLAN policies. Which approach aligns with ENCOR wireless segmentation?
Select an answer to reveal the explanation.
Short Explanation
Same AP, different name badges — profiles and tags give guest and staff their own policy without doubling the AP count. Turning everything open defeats the point.
Full Explanation
A museum that runs guest and staff SSIDs on the same APs but needs different WLAN policies should apply distinct WLAN profiles and tags so each SSID receives its own security, VLAN, and QoS treatment on shared AP infrastructure. That is the ENCOR controller-based segmentation pattern: one radio plant, multiple policy-bound WLANs.
Installing a second physical AP under every painting exclusively for staff fails by cost and concept—policy separation does not require doubling hardware per exhibit. Mapping both SSIDs to identical open policies so tags become unnecessary fails the requirement for different policies and weakens staff security. Using VRF-lite on each AP radio as the only supported SSID separator fails because AP radios are not configured as VRF-lite SSID separators in the standard lightweight model; segmentation is via WLAN/VLAN/policy bindings.
Exam caveat: Distinct profiles must map to distinct upstream VLANs/firewall policies; identical VLAN + open auth for “guest vs staff” is not meaningful segmentation even if SSID names differ.
Operational check: Bind guest and staff WLANs to different profiles/tags on the museum AP group; verify divergent security (e.g., open/web-auth vs 802.1X) and VLANs; test that a guest association cannot obtain staff policy attributes.