City inspectors must use hotel and conference Wi-Fi while traveling. What role should a VPN overlay play relative to the untrusted wireless LAN?
Select an answer to reveal the explanation.
Short Explanation
Hotel Wi-Fi is somebody else's living room. Assume it's hostile and wrap city traffic in a VPN. Trying to teach the hotel EAP-TLS or dusting off WEP is the wrong toolbox for an untrusted hop.
Full Explanation
City inspectors using hotel and conference Wi-Fi while traveling should treat that offsite WLAN as untrusted and use a VPN to protect confidentiality and integrity of city sessions traversing that path. VPN overlays do not make hotel RF trustworthy; they protect the session across an untrusted access network. Civic mobile workers handling permitting and case data need that assumption baked into standards.
Disabling the VPN so NAT on the hotel router can rewrite RADIUS EAPOL frames correctly misunderstands both VPN and EAPOL. Requiring hotel staff to issue city-managed EAP-TLS certificates to every guest room TV is fantasy operations. Replacing the VPN with WEP on the laptop so hotel APs learn the city PSK is obsolete and dangerous.
Exam caveat: VPN split-tunnel policy and MFA still matter—full tunnel versus split should follow data classification for inspector apps. Operational check: on a lab SSID simulating open hotel Wi-Fi, confirm city app traffic fails closed without VPN and succeeds with VPN plus expected MFA. In municipal WLAN programs, capture the decision in the wireless standard and re-check it at change review so the next project inherits the same control bar instead of rediscovering the failure during an outage. In municipal WLAN programs, capture the decision in the wireless standard and re-check it at change review so the next project inherits the same control bar instead of rediscovering the failure during an outage.