The county health campus wants posture checks before full staff VLAN access on Wi-Fi. Where does NAC belong in that architecture?
Select an answer to reveal the explanation.
Short Explanation
Think of 802.1X as proving identity and NAC as the health check before you get the good hallway key. On municipal Wi-Fi, NAC sits in that authorization path so sick or unmanaged devices land in quarantine instead of the staff VLAN. Pretty portals and spectrum tools are not that gate.
Full Explanation
Network Access Control (NAC) integrates into the authorization path alongside 802.1X authentication to enforce posture checks before granting full VLAN access on a municipal Wi-Fi network. After a device authenticates via 802.1X, NAC evaluates device compliance with security policies—such as updated antivirus, patches, or configuration baselines—and then dynamically assigns the device to an appropriate VLAN or places it in quarantine if non-compliant. This gating mechanism ensures that only devices meeting health requirements gain access to sensitive staff VLANs, thereby reducing attack surfaces. Merely using NAC as a guest splash page theme without policy enforcement fails to control access based on device posture, making it ineffective for security. Replacing encryption with NAC misunderstands NAC’s role; NAC controls access policy but does not provide confidentiality or integrity protections like CCMP encryption. Using NAC solely as a spectrum analyzer overlay without authentication, authorization, and accounting (AAA) hooks ignores its core function of access control and posture validation. A key caveat is that NAC effectiveness depends on integration with authentication protocols and network infrastructure capable of dynamic VLAN assignment. Operationally, verify that NAC can communicate with the RADIUS server and network switches to enforce VLAN changes post-authentication, confirming that devices failing posture checks are properly quarantined and cannot access the staff VLAN.