City hall visitors need internet access without reaching finance file shares. Which guest-network design choice should the technician implement from the design doc?
Select an answer to reveal the explanation.
Short Explanation
Guests get their own SSID/VLAN lane—not a free pass into payroll. Same SSID as staff, or a “guest” label that still dumps into staff subnets, is how visitors meet finance shares.
Full Explanation
City-hall visitors who need internet without reaching finance file shares require the guest network on a separate SSID and VLAN from staff. Segmentation is the core guest-network design choice at CWTS technician depth: different broadcast domain and SSID identity so ACLs/firewall policy can keep citizen devices off payroll printers and file shares. Implementing the design-doc guest SSID/VLAN is how field techs enforce that boundary.
Adding guests to the same SSID and VLAN used by payroll printers fails because shared L2/L3 adjacency gives visitors a path toward sensitive civic systems. Reusing the staff PSK on a second SSID that still trunks into staff subnets fails by concept: a “guest” label without separate VLAN/pathing is cosmetic. Turning off all ACLs because guest isolation is only a wired Ethernet idea fails because wireless guests still need Layer-2/3 isolation and filtering; air does not invent isolation by itself.
Exam caveat: SSID name alone is not segmentation. CWTS expects separate SSID and VLAN (plus policy) for municipal guest versus staff.
Operational check: create/verify guest SSID mapped to a non-staff VLAN; confirm DHCP is from the guest scope; attempt access to a finance share from a guest test client and verify deny; document that staff PSK is never used on the public guest path.