A city visitor-center WLAN must show guests an acceptable-use policy and record acceptance before Internet access begins. Which design best meets that goal?
Select an answer to reveal the explanation.
Short Explanation
Think of the captive portal like the turnstile at city hall: you see the rules, tap accept, then you get in. A flyer on the counter does not create a session start, and borrowing staff 802.1X is the wrong door for the public.
Full Explanation
Using a captive portal that presents the acceptable-use policy (AUP) and grants guest sessions only after acceptance is the most effective design for a city visitor-center WLAN aiming to ensure compliance before Internet access. This method technically intercepts HTTP(S) requests and redirects users to a web page displaying the AUP, requiring explicit user interaction to accept terms before network access is granted. This approach enforces policy acknowledgment and creates a record of acceptance, which is essential for legal and operational accountability. Simply publishing the AUP on a printed flyer while leaving the SSID open provides no technical enforcement; users can connect without any acknowledgment, undermining policy compliance. Sharing a single WPA3-Enterprise profile with visitors bypasses the captive portal mechanism, removing the opportunity to present or record acceptance of terms, and risks credential misuse. Relying solely on DNS sinkholing without presenting terms or capturing acceptance fails to inform users or obtain consent, as DNS sinkholing only blocks or redirects certain domain lookups but does not enforce policy acceptance. It is important to note that captive portals may not work seamlessly with all device types or encrypted DNS, so fallback mechanisms should be considered. Operationally, the network administrator should verify that the captive portal triggers before any Internet traffic is allowed and that acceptance records are securely stored for audit purposes.