A municipal security architect describes defense-in-depth for WLAN user traffic as it leaves the air and enters the wired campus. Which stacked control set best matches that layered approach?
Select an answer to reveal the explanation.
Short Explanation
Defense-in-depth for Wi-Fi isn’t one hero control—it’s locks on the air (strong AKM/ciphers), lanes on the wire (VLANs), and a gatehouse (firewall) for what leaves the neighborhood. Skip the stack and you’re hoping antivirus covers for bad architecture.
Full Explanation
Defense-in-depth for municipal WLAN user traffic as it leaves the air and enters the wired campus stacks RF confidentiality and integrity via appropriate AKM and ciphers, wired segmentation such as VLANs for different user classes, and firewall or ACL enforcement for north-south and appropriate east-west traffic control. Layering keeps air-link, campus, and boundary risks from sharing a single failure point. Civic architects should describe that stack explicitly rather than hoping one hero control covers every hop from association to application. Using open SSIDs only, a single flat VLAN, and endpoint antivirus as the sole control abandons link security and segmentation. Disabling encryption so WIPS can inspect all payloads, then trusting MAC allow-lists alone, trades confidentiality for weak identity theatre. Placing every AP on a public /24 routed straight to the Internet without ACL or VLAN separation is the opposite of layered campus design for city buildings. Exam caveat: monitoring tools that “need cleartext” should use authorized decrypt, span, or metadata analytics designs—not production SSID encryption disablement that exposes every municipal client. Operational check: trace a staff session from association through VLAN assignment to firewall hit counters, and confirm each layer—cipher and AKM, segment, and policy—is present and logged before signing off the architecture review.