NAC marks a contractor laptop non-compliant during posture check on the city employee SSID. What network design element best supports remediation?
Select an answer to reveal the explanation.
Short Explanation
Failed posture means time-out, not free-for-all. Drop non-compliant gear on a quarantine VLAN with just enough reach to get healthy. Full access, SCADA shortcuts, and sticker patrols are not NAC.
Full Explanation
When NAC marks a contractor laptop non-compliant during posture check on the city employee SSID, the network design should place the device on a quarantine VLAN with limited access to remediation resources until posture passes. Quarantine preserves a path to fix disk encryption, agents, or patches without granting full corporate access. Civic contractor onboarding fails when non-compliance either gets full access or hard-denies without remediation.
Granting full VLAN access immediately so the laptop can download malware patches from peer PCs defeats NAC. Bridging the laptop into the SCADA VLAN where scanners are less aggressive is reckless. Disabling NAC and relying on a lobby greeter to inspect antivirus stickers is not a control.
Exam caveat: quarantine must allow only remediation endpoints such as MDM, patch, and AV portals—not general Internet as a loophole. Operational check: fail a posture check on purpose, confirm quarantine VLAN and limited reachability, remediate, and verify automatic promotion to the employee role or VLAN. In municipal WLAN programs, capture the decision in the wireless standard and re-check it at change review so the next project inherits the same control bar instead of rediscovering the failure during an outage.