Guest-to-staff deny ACLs protect a civic WLAN. How should those ACLs also support operations beyond silent blocking?
Select an answer to reveal the explanation.
Short Explanation
Denies are better when they also talk. Log guest-to-staff ACL hits into monitoring so someone sees the probes. Silent deletes or sticky notes are not visibility.
Full Explanation
Guest-to-staff deny ACLs that protect a civic WLAN should also support operations by enabling ACL logging on denied guest-to-staff attempts so events feed monitoring. Silent blocks prevent the connection but leave SOC and network teams blind to scanning, misconfiguration, or intentional probing from the guest segment. Logged denies turn the ACL into both a preventive control and a detection source for municipal visibility and incident response. Deleting deny hits hourly so dashboards stay empty destroys evidence and undermines monitoring usefulness. Replacing ACLs with sticky notes on the firewall rack is not an enforceable technical control. Allowing guest-to-staff briefly each night for informal “connectivity tests” creates a scheduled bypass that attackers or malware can simply wait for. Exam caveat: log volume from noisy guest networks may require rate limits or aggregation—tune carefully without disabling the signal that guest hosts are probing staff networks. Operational check: from a guest test client, attempt a connection to a staff server, confirm the deny is logged into the monitoring pipeline with usable source identity, and verify an alert or dashboard panel surfaces the event within the agreed operational window.