A single hospital SSID is used by both staff and visiting family members, but each group needs to reach very different resources once connected: staff need clinical systems, and visitors need only internet access. Which approach lets one SSID serve both groups with different network access?
Select an answer to reveal the explanation.
Short Explanation
One door, two different key cards. The SSID itself is just the door — it's the role assigned after login that decides whether you walk into the clinical wing or stay in the visitor lounge.
Full Explanation
Role-based access lets a single SSID differentiate treatment per client by assigning a role at authentication time, with each role carrying its own firewall policy, VLAN, and permitted destinations, so staff credentials map to a staff role reaching clinical systems while a visitor credential or guest flow maps to a restricted role limited to internet access. This avoids needing a separate SSID per audience, which would multiply RF overhead and management complexity for no security benefit, since a hidden SSID broadcasts nothing different in terms of enforced policy and hidden network names are trivially discoverable anyway. Lowering AP transmit power during certain hours changes coverage and signal strength, not which resources a connected client can reach, and it would also degrade service for legitimate staff during those hours. A longer DHCP lease time only affects how often a client renews its IP address lease and has no bearing on firewall policy or resource access. To validate this design, authenticate as each user type on the same SSID and confirm the staff session can reach a clinical server while the visitor session is blocked from it, proving the role, not the SSID, is doing the enforcement.