A city WLAN carries employee laptops, guest tablets, and building IoT sensors on the same SSID and VLAN today. Which segmentation approach best aligns with layered WLAN-supporting security?
Select an answer to reveal the explanation.
Short Explanation
Staff, guests, and thirsty IoT sensors shouldn’t share one swimming pool. Separate VLANs (and usually SSIDs or dynamic assignment) give each group its own lane so a compromised lightbulb doesn’t get a free paddle to HR file shares.
Full Explanation
A city WLAN that carries employee laptops, guest tablets, and building IoT sensors on the same SSID and VLAN fails basic layered segmentation. The better approach places staff, guest, and IoT users on separate VLANs—with corresponding WLAN or SSID mapping or dynamic VLAN assignment—to isolate trust zones. Segmentation limits blast radius so a compromised sensor or guest device does not get a free Layer 2 path to HR file shares or staff endpoints on the municipal campus. Keeping one flat VLAN while rotating a shared PSK weekly still leaves all three populations co-located at Layer 2 regardless of passphrase choreography. Bridging all three to the same Layer 2 domain so firewalls never see east-west traffic intentionally blinds policy enforcement. Placing only IoT on a VPN concentrator while staff and guests remain co-located on the production VLAN leaves the largest human populations unsliced. Exam caveat: VLAN separation must be paired with ACLs or firewall policy; a VLAN ID alone is not a magical security boundary if inter-VLAN routing is wide open between zones. Operational check: from a guest and an IoT test client, attempt to reach staff subnets and administrative services, confirm denies at the intended enforcement point, and verify dynamic or SSID-based VLAN assignment matches the written zone matrix.