Unknown devices freely attach to the campus LAN at a municipal operations center. Which control best restricts network admission?
Select an answer to reveal the explanation.
Short Explanation
If any stranger’s laptop can just plug in and join, your LAN is a free parking lot. NAC asks 'who are you and are you healthy?' before handing out real network keys—and parks unknowns in a side lot.
Full Explanation
When unknown devices freely attach to the municipal operations-center LAN, the network grants production connectivity without identity or health checks. Network Access Control requires endpoints to authenticate and meet posture requirements before receiving production access, and it offers guest or quarantine networks for unknowns that fail those checks. That admission control stops casual plug-in attacks, limits contractor laptops to appropriate segments, and creates an enforcement point for agent presence, patch level, or certificate status before finance and operations VLANs become reachable.
Disabling all switch port security to maximize plug-and-play for contractors removes the very gates NAC and port controls provide. Assigning every unknown MAC a permanent static DHCP reservation on the finance VLAN rewards strangers with durable privileged addressing. Relying solely on a printed acceptable-use poster at reception states policy without any technical enforcement on the wire.
Exam caveat: CISSP network access control topics expect authentication and posture before trust. Administrative posters and permanent reservations for unknowns are distractors against real admission control.
Operational check: enable 802.1X or equivalent NAC on operations-center access switches; define quarantine VLAN with remediation only; verify failed auth cannot reach finance; onboard contractors to time-bound profiles; and review NAC logs for repeated unknown MAC attempts.