City visitor Wi-Fi must not reach staff file shares or internal VLANs. Which guest-access design best meets that goal?
Select an answer to reveal the explanation.
Short Explanation
Guest Wi-Fi is the sidewalk café—Internet coffee, not keys to City Hall file rooms. Park visitors on an isolated SSID with Internet-only policy and keep staff VLANs out of reach. Shared payroll VLANs are how cafés become break-ins.
Full Explanation
To prevent city visitor Wi-Fi users from accessing staff file shares or internal VLANs, the best guest-access design isolates the guest SSID from staff VLANs and enforces an Internet-only policy. This segregation ensures that guests are confined to a network segment with no routing or firewall exceptions to internal resources, protecting sensitive municipal data and systems. Implementing VLAN separation combined with firewall rules and access control lists (ACLs) effectively blocks unauthorized lateral movement. Placing guests on the same VLAN as payroll servers simplifies routing but dangerously exposes critical financial systems to untrusted users. Granting guests read-write SMB access undermines security by allowing potential modification or deletion of files, violating data integrity principles. Disabling firewalls between guest and finance during business hours removes essential barriers and invites exploitation. It is critical to understand that guest network isolation must be enforced at multiple layers, including VLAN, firewall, and wireless controller settings, to ensure comprehensive protection. Operationally, network administrators can verify isolation by attempting to access internal resources from guest devices and confirming that firewall logs show blocked attempts.