A network engineer wants a new SSID for tablet carts to broadcast only from the access points inside the new pediatric clinic wing, and not from any other AP on the hospital campus. Rather than configuring each AP individually, what is the most efficient way to scope this?
Select an answer to reveal the explanation.
Short Explanation
AP groups exist for exactly this — they let you draw a line around a set of access points and push settings only inside that line. Put the pediatric wing's APs in their own group, apply the WLAN there, and every other AP on campus never even sees it.
Full Explanation
AP groups are the mechanism for scoping configuration to a defined subset of access points: grouping the pediatric wing's APs together and applying the new WLAN profile to that group only ensures the SSID is broadcast exclusively from those radios, while every other group on campus is untouched. Adjusting broadcast power does not scope an SSID logically at all — it only affects signal range, and a strong enough signal or a roaming client could still pick it up outside the intended footprint, plus it does nothing to prevent the WLAN from technically existing elsewhere. Deploying the SSID everywhere and trusting staff behavior isn't a technical control at all; it relies on people doing the right thing rather than the network enforcing scope, which is not how a design requirement should be met. An AP administrator password has nothing to do with which WLAN profiles that AP broadcasts — it protects management access to the device, not SSID scoping. A caveat: moving an AP between groups later re-applies that group's entire configuration set, not just the one WLAN, so group membership changes should be planned deliberately. Operational check: from an AP confirmed to be outside the pediatric wing group, verify the new tablet-cart SSID does not appear in a site survey scan.