City WLAN carries corporate, guest, and IoT SSIDs. What wired-side practice is essential?
Select an answer to reveal the explanation.
Short Explanation
Different Wi-Fi neighborhoods need different streets on the wire. Corp, guest, and IoT belong on separate VLANs with deliberate paths between them. One big flat LAN is how a guest phone meets a domain controller.
Full Explanation
When city WLAN carries corporate, guest, and IoT SSIDs, wired-side practice must segment each SSID class onto distinct VLANs with controlled routing between them. SSID names are labels; enforcement lives in VLAN assignment, ACLs, and firewall policy that keep visitors and brittle IoT away from domain resources. Municipal multi-SSID designs fail open when everything lands on one flat network for simplicity.
Bridging all SSIDs onto a single flat VLAN to simplify spanning tree maximizes blast radius. Putting guest and IoT clients into the same broadcast domain as domain controllers is a classic segmentation failure. Using SSID names alone as the only separation with no VLAN mapping provides no enforceable boundary.
Exam caveat: segmentation design should include DHCP/DNS placement and inter-VLAN allow-lists for only required services. Operational check: from a guest and an IoT client, attempt access to a corporate resource and confirm denial; verify each SSID maps to the intended VLAN ID in controller and switch configs. In municipal WLAN programs, write the control into standards and verify it during change review so the next project inherits the same bar rather than rediscovering the failure mode under outage pressure.