City hall separates a guest WLAN VLAN from corporate services. Which device role should sit between those segments to inspect and filter that traffic?
Select an answer to reveal the explanation.
Short Explanation
Guests next to corporate apps need a real policy choke point. Put a firewall between the guest WLAN VLAN and corporate services. A splash page alone or a random switch is not that boundary.
Full Explanation
When city hall separates a guest WLAN VLAN from corporate services, a firewall should sit between those segments to inspect and filter that traffic. The firewall is the policy choke point that can allow Internet-bound guest flows while denying corporate application and management destinations, with logging for SOC visibility. Civic guest designs that stop at a splash page without a real network boundary leave corporate services exposed to anyone who associates. An unmanaged desktop switch in the council chamber only provides connectivity, not inspected policy between trust zones. A battery backup for lobby digital signage is power resilience, not segmentation. A captive-portal splash page with no network policy behind it accepts terms without enforcing destination restrictions on the guest VLAN. Exam caveat: firewall rules must match how guest traffic is forwarded—local breakout versus tunneled DMZ—or the “firewall between VLANs” exists only on the diagram. Operational check: generate guest traffic toward a corporate file share and toward an allowed Internet site, confirm the firewall denies the corporate attempt and permits the Internet attempt, and retain the log evidence for the guest segmentation standard.