Public library Wi-Fi must serve patrons without reaching staff file shares or the integrated library system. Which wireless design best enforces that separation?
Select an answer to reveal the explanation.
Short Explanation
Patrons need Internet, not a shortcut into HR folders. Separate SSIDs and VLANs with a firewall that says 'guests stop here' keep library public Wi-Fi from becoming a free lobby into staff systems.
Full Explanation
Public library Wi-Fi must give patrons Internet access without a free path into staff file shares or the integrated library system. Isolating guest and patron SSIDs onto separate VLANs or VRF paths, then applying firewall policy that denies staff-resource access, enforces that boundary in infrastructure rather than in hope. Staff devices should use separately authenticated enterprise SSIDs with stronger identity controls. Network-enforced separation is what keeps a patron laptop from becoming a lobby into HR folders and circulation databases.
Using one SSID for everyone and relying on users not to browse staff shares is policy theater without enforcement. Putting patrons on the staff SSID with only a captive-portal splash page authenticates acceptance of terms, not separation of trust—after the splash, patrons share the staff broadcast domain. Bridging guest Wi-Fi directly into the staff VLAN to simplify printing collapses isolation for a convenience feature that should instead use mediated print services.
Exam caveat: CISSP wireless design expects SSID/VLAN isolation and firewall policy between guest and internal resources. Captive portals and user good behavior are not substitutes for segmentation.
Operational check: verify patron VLANs cannot route to staff file servers or ILS addresses; confirm staff SSIDs require 802.1X or equivalent; provide printing via a controlled gateway if needed; and penetration-test from a patron association to demonstrate deny results.