Campus IT proposes terminating every city employee laptop into a VPN concentrator instead of deploying 802.1X on the corporate SSID. What is the sound security-architecture position?
Select an answer to reveal the explanation.
Short Explanation
On campus, 802.1X is the badge reader at the building door; VPN is the armored truck you use on the public highway. You do not rip out the badge system because trucks exist. Use both in the right places—enterprise link auth on the corporate SSID, VPN when the path is untrusted.
Full Explanation
Sound campus architecture for city employee laptops keeps strong 802.1X authentication and link encryption on the corporate SSID while treating VPN as a complement for remote or otherwise untrusted paths. Enterprise link security authenticates the station at the edge and protects RF frames inside the civic campus; VPN protects sessions when the path crosses networks the city does not control. Substituting one control for the other collapses defense-in-depth and creates a single point of architectural failure. Leaving the corporate SSID open because “VPN will fix it” exposes campus RF, weakens edge admission, and burdens every east-west campus flow with an inappropriate remote-access pattern. Disabling VPN forever once any WPA2 PSK exists ignores remote-work and hotel-path needs and may over-trust a shared Personal secret. Replacing both VPN and 802.1X with MAC allow-lists alone provides spoofable identity theatre without modern AKM or session cryptography. Exam caveat: some agencies use always-on VPN even on campus for overlay policy, but that still does not justify an open or weakly authenticated corporate SSID as the CWSP-preferred campus pattern. Operational check: verify the corporate SSID enforces 802.1X with a modern cipher suite in production, then confirm remote users cannot reach sensitive apps from a public SSID without the VPN posture and routing your policy requires.