A county WLAN design discussion focuses on microsegmentation after 802.1X. How should WLAN roles typically map for segmentation?
Select an answer to reveal the explanation.
Short Explanation
Microsegmentation on enterprise Wi-Fi often means RADIUS says who you are, then a dynamic VLAN parks you. One flat VLAN or emoji SSIDs are not role-based segmentation.
Full Explanation
In a county WLAN design discussion about microsegmentation after 802.1X, WLAN roles typically map to dynamic VLANs assigned after RADIUS authorization. Identity-driven authorization returns attributes that place clinicians, guests, contractors, or IoT into different segments without requiring a unique SSID per role. That mapping is how enterprise Wi-Fi turns authentication success into network placement for civic microsegmentation goals across clinics, offices, and field facilities. Requiring every role to share one flat VLAN merely to simplify spanning tree abandons segmentation after the organization already invested in 802.1X. Encoding roles only in SSID emoji names is not enforceable authorization and will not survive an audit. Relying solely on client wallpaper policies does not control Layer 2 or Layer 3 reachability on the municipal campus once a device associates. Exam caveat: dynamic VLAN designs need matching switch and controller support plus correct DHCP scopes; a RADIUS attribute without a wired VLAN that exists will strand clients after a successful EAP exchange and create false “Wi-Fi is down” tickets. Operational check: authenticate two distinct roles to the same enterprise SSID, confirm each receives a different VLAN ID via RADIUS attributes, and verify inter-role traffic is denied per the segmentation matrix while same-role access continues to work.