County free Wi-Fi in the permit office allows guest devices to reach each other on the same SSID. Which mitigation best reduces client-to-client attacks on that guest WLAN?
Select an answer to reveal the explanation.
Short Explanation
Open guest Wi-Fi without isolation is a shared cafeteria table where every laptop can poke its neighbor. Flip on client isolation so visitors reach the Internet (and the portal), not each other’s files.
Full Explanation
Guest devices on county free Wi-Fi in a permit office often sit on a flat Layer-2 wireless segment where peer-to-peer traffic is allowed by default. Enabling client isolation (peer-to-peer blocking) prevents associated guest stations from communicating directly with each other, which sharply reduces lateral malware movement, scanning, and client-to-client attacks while still allowing Internet-bound forwarding according to policy. Sharing one staff PSK with permit applicants collapses guest and staff trust boundaries and invites credential misuse. Bridging the guest SSID onto the assessor VLAN places untrusted visitors next to internal resources and defeats segmentation. Disabling AP radios during lunch creates availability outages without addressing peer communication whenever the SSID is up. Exam caveat: client isolation is a guest/open WLAN control; it is not a replacement for encryption, captive-portal policy, or upstream firewalling of guest VLANs toward civic networks. Operational check: enable peer-to-peer block on the permit-office guest WLAN, verify two test phones on that SSID cannot ping or browse each other while both still reach the permitted Internet path, and confirm staff VLANs remain unreachable from guest. Capture the isolation setting in the municipal guest SSID standard so temporary event networks inherit the same control.