A municipal guest VLAN must reach the Internet but must not talk to staff servers. Where should ACLs primarily enforce that Internet-only restriction?
Select an answer to reveal the explanation.
Short Explanation
Internet-only guests need wired ACLs where that VLAN hits the campus. Distribution-layer ACLs block staff destinations while allowing egress. Renaming SSIDs or dimming RF is not access control.
Full Explanation
A municipal guest VLAN that must reach the Internet but must not talk to staff servers should primarily enforce that Internet-only restriction with ACLs on the distribution layer where guest VLAN traffic hits the campus routing boundary. Distribution-layer enforcement is positioned to allow necessary egress while denying east-west paths into staff networks, independent of what a splash page displays. That is where civic designers usually put durable guest isolation for wired and wireless VLAN traffic alike. Enforcing the rule only inside guest browser bookmarks on loaner tablets is not network access control and fails as soon as a patron uses their own device. Renaming the guest SSID weekly does not restrict destinations. Lowering AP transmit power in the lobby changes RF coverage, not IP reachability to staff servers. Exam caveat: if guest traffic is tunneled centrally, place equivalent ACLs at the tunnel termination or firewall edge so the control still sits in the actual forwarding path. Operational check: from a guest association, attempt connections to representative staff servers and confirm denies logged on the distribution or DMZ ACL, then verify Internet HTTPS egress still succeeds for the same client.