A public health clinic’s IoT WLAN segment must not reach electronic health record (EHR) servers. Which control best limits that lateral movement?
Select an answer to reveal the explanation.
Short Explanation
IoT gadgets and EHR servers should not be pen pals. An ACL that denies IoT VLAN traffic to EHR networks blocks that lateral hop. Louder SSIDs and paper logs are not network segmentation.
Full Explanation
A public health clinic’s IoT WLAN segment must not reach electronic health record servers, and the control that best limits that lateral movement is an ACL denying traffic from the IoT VLAN to EHR server networks. Segmentation plus explicit deny policy keeps badge readers, sensors, and similar devices from becoming a bridge into clinical systems even if an IoT host is compromised. Clinic WLAN security design treats IoT as a distinct trust zone with tightly scoped destinations. Broadcasting the EHR SSID more loudly than the IoT SSID does not create a Layer 3 or Layer 4 isolation boundary. Disabling DHCP on all clinic printers overnight is unrelated noise that harms operations without protecting EHR networks. Replacing every IoT badge with a paper visitor log abandons the network control the question asks for and does not stop wireless IoT traffic that remains online. Exam caveat: default-allow inter-VLAN routing will bypass “separate VLAN” intentions unless the deny ACL or firewall rule is actually applied and tested. Operational check: place a test host on the IoT VLAN, attempt TCP connections to EHR server addresses, confirm the ACL counters increment on deny, and verify required IoT controllers or update repos that should remain reachable still work.