Remote city workers often join from untrusted café Wi-Fi, then VPN into municipal systems. What firewall posture best fits that path?
Select an answer to reveal the explanation.
Short Explanation
Café Wi-Fi is untrusted even after a VPN pops up. Treat VPN ingress with stateful firewall policy, not blanket trust. Café splash pages are not municipal EAP-TLS.
Full Explanation
Stateful firewall policy should treat VPN users who originate on untrusted Wi-Fi as a controlled but still scrutinized ingress path into municipal networks. The VPN encrypts transit, yet authorization, logging, and least-privilege filtering still apply at the edge. Equating café portals with enterprise EAP-TLS or failing open into sensitive VLANs weakens that architecture.