Some wireless clients fail NAC posture on the city WLAN. Which network response best supports remediation without full staff access?
Select an answer to reveal the explanation.
Short Explanation
Failed posture should mean quarantine VLAN homework, not a VIP pass to staff or admin nets. Remediation networks exist for that. Domain-admin bridging is the wrong gold star.
Full Explanation
When some wireless clients fail NAC posture on the city WLAN, the network response that best supports remediation without full staff access is placing those clients on a quarantine VLAN. Quarantine provides limited connectivity to remediation resources—update servers, portals, or help-desk tools—while keeping failed endpoints off production staff segments. That pattern preserves both security and a path back to compliance for municipal users. Granting full staff VLAN access and ticketting the failure later abandons the posture gate at the moment it mattered. Permanently disabling the client radio in firmware from the cloud is an extreme response that is usually out of scope and operationally destructive. Bridging failed clients directly into the domain admin VLAN rewards failure with higher privilege and is the opposite of quarantine design. Exam caveat: quarantine VLANs must be carefully ACL’d—too open and they become a launch pad; too closed and users cannot remediate, creating political pressure to disable NAC. Operational check: fail posture on a test client, confirm assignment to the quarantine VLAN with access only to documented remediation destinations, remediate, and confirm automatic or manual move to the staff VLAN afterward with logs retained.