County policy requires wireless staff devices to show healthy antivirus posture before receiving the full staff VLAN. Which control implements that gate?
Select an answer to reveal the explanation.
Short Explanation
Want into the staff VLAN? NAC posture checks should verify antivirus health before granting access. Honor surveys, beacon tweaks, and disabling RADIUS accounting are not admission control.
Full Explanation
County policy that requires wireless staff devices to show healthy antivirus posture before receiving the full staff VLAN is implemented with Network Access Control posture checks that verify antivirus and related health signals before granting full staff VLAN access on Wi-Fi. NAC ties authorization outcomes to endpoint hygiene so a laptop that associates and authenticates still cannot reach the full staff segment until posture agents report acceptable state. That gate aligns wireless admission with endpoint security policy for county staff mobility.
An honor-system survey emailed monthly to laptop owners is not continuous admission control and cannot block unhealthy devices in real time. Increasing beacon interval until insecure clients roam away is RF tinkering, not posture enforcement. Disabling RADIUS accounting so posture failures leave no trail removes visibility and does not implement a health gate at all.
Exam caveat: posture checks need accurate agents, exception handling for medically or operationally constrained devices, and a remediation path—otherwise NAC becomes a help-desk outage generator without improving security outcomes.
Operational check: place a lab staff laptop with intentionally failing antivirus posture on the WLAN, confirm it is denied full staff VLAN access, remediate the posture condition, and verify subsequent authorization places it on the staff VLAN with accounting evidence retained.