The outpatient annex across the road connects back to the main hospital campus over a modest point-to-point wireless link. The design wants staff clinical traffic tunneled back to the main campus for policy enforcement, while general internet-bound guest traffic at the annex exits locally to avoid straining that link. Which forwarding approach matches this?
Select an answer to reveal the explanation.
Short Explanation
Not every WLAN has to be treated the same way — that's exactly what split-tunnel forwarding is for. Send the clinical traffic back to campus where it needs policy enforcement, and let the guest traffic go straight to the internet locally, so the skinny link isn't carrying cat videos.
Full Explanation
Split-tunnel forwarding lets a single AP apply different forwarding behavior per WLAN: the clinical SSID can be tunneled back to the main campus for centralized policy and firewalling, while the guest SSID's internet-bound traffic is broken out locally at the annex, which is exactly the mixed requirement described — policy enforcement where it matters, and bandwidth conservation where it doesn't. Full tunnel mode for every WLAN would force guest internet traffic over the same constrained point-to-point link as clinical traffic, directly contradicting the stated goal of protecting that link's capacity. Bridge mode for every WLAN goes too far the other way — clinical traffic would never reach the main campus for the policy enforcement the design explicitly calls for, breaking that requirement entirely. Mesh mode addresses a different problem (providing wireless AP-to-AP connectivity when a wired path isn't available) and doesn't describe how client traffic is ultimately forwarded once it reaches a WLAN; it isn't a substitute for tunnel-versus-local forwarding decisions. A caveat: split-tunnel decisions are usually made per-WLAN, so getting the clinical and guest traffic on the correct SSIDs in the first place is a prerequisite for this to work as intended. Operational check: confirm guest traffic's source address at the internet edge shows the annex's local breakout, not the main campus gateway.