Before city employees reach the corporate SSID, devices must prove patch and disk-encryption posture. Which control provides that gate?
Select an answer to reveal the explanation.
Short Explanation
A fancy SSID name does not mean the laptop is healthy. NAC plus MDM posture is the bouncer that checks patches and encryption before the corp Wi-Fi party. Policy PDFs and MAC lists alone do not prove device health.
Full Explanation
Before city employees reach the corporate SSID, devices must prove patch and disk-encryption posture through NAC checks integrated with MDM/WLAN admission. Posture-gated admission prevents unmanaged or unhealthy endpoints from obtaining full employee network access merely because someone knows a password or holds a certificate for a non-compliant machine. Municipal endpoints that handle citizen data need that health gate as part of wireless security architecture.
SSID rename alone does not discourage unmanaged devices in any meaningful technical sense. A captive portal that only displays the AUP PDF acknowledges policy without measuring patch or encryption state. Static MAC allow-lists with no ongoing health validation are spoofable and stale.
Exam caveat: posture checks require reliable MDM telemetry and a remediation path—blocking without quarantine resources creates shadow workarounds. Operational check: present a non-compliant test laptop, confirm it is denied full access or placed in remediation, remediate disk encryption/patch state, and verify subsequent full admission. In municipal WLAN programs, write the control into standards and verify it during change review so the next project inherits the same bar rather than rediscovering the failure mode under outage pressure.