Malware on one library guest laptop begins scanning other devices on the open public SSID. Which control best limits lateral movement?
Select an answer to reveal the explanation.
Short Explanation
On guest Wi-Fi, strangers should not talk to strangers. Client isolation cuts the peer path malware loves. Dumping guests onto staff VLANs or weird IP tricks makes the blast radius worse.
Full Explanation
When malware on one library guest laptop begins scanning other devices on the open public SSID, client isolation / peer-to-peer blocking is the control that best limits lateral movement. Guests should reach approved upstream services, not each other’s file shares and vulnerable endpoints. Civic library Wi-Fi without isolation turns a single infected machine into a LAN worm festival.
Bridging all guest clients into the staff VLAN for centralized antivirus scanning collapses segmentation. Assigning every guest the same static IP to simplify firewall rules breaks uniqueness and does not stop peer traffic. Disabling DHCP so infected hosts use APIPA peering can encourage link-local discovery rather than stop it.
Exam caveat: isolation does not stop Internet-borne C2—combine with upstream filtering and portal policy. Operational check: place two guest clients on the SSID, attempt peer pings/shares, confirm failure under isolation, and verify each still reaches the intended upstream allow-list. In municipal WLAN programs, capture the decision in the wireless standard and re-check it at change review so the next project inherits the same control bar instead of rediscovering the failure during an outage. In municipal WLAN programs, capture the decision in the wireless standard and re-check it at change review so the next project inherits the same control bar instead of rediscovering the failure during an outage.