Contractors authenticate successfully to the municipal Wi-Fi, but policy must still keep them off finance SSID resources. Which control enforces that after authentication?
Select an answer to reveal the explanation.
Short Explanation
Authentication is the front-door badge scan; authorization is whether that badge opens the vault. RBAC is the vault rule that says contractors stay out of finance even after they prove who they are. Turning the SSID open or cranking RF does not draw that line.
Full Explanation
In a municipal Wi-Fi environment where contractors authenticate successfully but must be restricted from accessing finance SSID resources, the enforcement of access control after authentication is best achieved through role-based access control (RBAC). RBAC assigns permissions based on user roles, ensuring that only approved staff roles can access sensitive finance resources, regardless of successful network authentication. This granular authorization prevents contractors from reaching restricted data even if they connect to the network. Increasing RF power on finance-floor APs does not restrict access logically; it merely extends coverage and could inadvertently allow unauthorized devices to connect. Switching the finance SSID from WPA3 to open removes encryption and authentication protections, exposing sensitive resources to anyone nearby, which is counterproductive. Disabling AAA accounting reduces logging and auditing capabilities, which are critical for security monitoring and compliance, but does not enforce access restrictions. It is crucial to implement RBAC in coordination with AAA servers and network devices to ensure consistent enforcement. Operationally, test that contractors can authenticate but receive network access restrictions preventing finance resource connectivity, confirming RBAC effectiveness.