Biomedical devices roam between wards on the hospital campus, but the security team wants their traffic to always be tunneled back to the same central policy enforcement point no matter which access point or wiring closet they associate through, rather than being switched locally at each edge. Which concept describes this approach?
Select an answer to reveal the explanation.
Short Explanation
Instead of trusting whichever local switch a device happens to plug into, dynamic segmentation builds a tunnel that carries the device's traffic straight back to one consistent enforcement point, like a hallway that always leads to the same security desk no matter which door you came in.
Full Explanation
Dynamic segmentation using a user-based tunnel decouples policy enforcement from the physical access layer: rather than relying on a device landing on the correct VLAN at whichever edge switch or AP it happens to associate with, the client's traffic is tunneled to a central point where consistent role-based policy is applied regardless of location. This is valuable for roaming biomedical equipment because it removes the need to replicate identical VLAN and ACL configuration at every wiring closet the device might touch as it moves between wards. Spanning-tree root guard is a loop-prevention safeguard that stops a rogue switch from becoming the root bridge; it has nothing to do with where policy is enforced. Static VLAN trunking between access switches extends VLANs across the wired infrastructure but still requires that VLAN to be consistently provisioned everywhere the device roams, which is the very problem dynamic segmentation avoids. Link aggregation bundles physical ports for bandwidth and redundancy and is unrelated to how or where a client's policy is applied. A practical validation step is moving the tunneled device to a different ward and confirming its role and firewall policy stay identical, since the tunnel, not the local VLAN, is what determines its treatment.