Retail-facing city HQ wants machines to authenticate to Wi-Fi before user logon and users to authenticate afterward for staff access. Which design direction is appropriate?
Select an answer to reveal the explanation.
Short Explanation
Machine auth is the laptop flashing its badge at boot; user auth is the person badge after login. Enterprise 802.1X with computer accounts can do both. A under-keyboard PSK or a guest portal isn’t that design.
Full Explanation
Retail-facing city HQ wanting machines to authenticate to Wi-Fi before user logon and users afterward needs 802.1X Enterprise with an EAP method and computer/user identity integration—for example domain computer accounts—supporting machine and user authentication. One WPA2-Personal PSK taped under each cash-wrap laptop cannot provide machine-then-user identity. Open guest portal credentials shared as the staff SSID secret collapse trust. Disabling authentication until after the desktop firewall starts leaves the pre-logon window unprotected and misses the machine-auth goal. Exam caveat: machine authentication before user logon is an Enterprise 802.1X/directory design feature, not a Personal PSK or portal pattern. Operational check: configure computer authentication against city RADIUS/AD, confirm connectivity at the Ctrl-Alt-Del screen for policy/GPO needs, then verify user auth elevates access as designed. Document the dual-auth flow in the municipal endpoint WLAN guide for retail and HQ support staff. In municipal WLAN operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the infrastructure versions and client fleets used by the civic environment.