Finance servers and guest Wi-Fi clients currently share one flat VLAN in city hall. What logical segmentation approach should the architect apply?
Select an answer to reveal the explanation.
Short Explanation
Guests and finance on one flat VLAN is a mixer party for malware. Carve separate VLANs—and tighter routing constructs when needed—so visitors cannot stroll into payroll.
Full Explanation
Finance servers and guest Wi-Fi clients sharing one flat VLAN collapse distinct trust zones into a single broadcast and security domain inside city hall. Logical segmentation—separate VLANs with inter-VLAN filtering, and complementary constructs such as VRFs or VPNs where deeper routing separation is needed—places guests and finance in distinct policy domains so visitors cannot directly reach payroll and financial systems. Segmentation is the scalable alternative to hoping a flat campus LAN remains benign after a guest device is compromised.
Renaming the flat VLAN “Secure” in documentation changes labels, not packets or reachability. Putting finance databases on the guest SSID for auditor demos maximizes exposure under a demonstration excuse. Disabling switching to bridge every port into one collision domain worsens both performance and security by enlarging the shared failure domain.
Exam caveat: CISSP treats logical segmentation via VLANs, VPNs, and virtual routing (VRF) as standard Domain 4 architecture; documentation cosmetics and flat convenience designs are not controls.
Operational check: create separate guest and finance VLANs; apply ACLs or firewall policies denying guest-to-finance paths by default; consider VRF for route-table isolation where required; map SSIDs only to appropriate VLANs; verify with traffic tests from a guest client; monitor for VLAN hopping and mis-trunking; review DHCP scopes so guests never receive finance addressing.