A municipal auditor asks what client isolation changes about station-to-station traffic on an AP. What is correct?
Select an answer to reveal the explanation.
Short Explanation
Isolation is like hotel rooms that don’t interconnect—you still need locks on the hallway door. It stops guest-to-guest chatting through the AP; it isn’t the whole security story.
Full Explanation
Client isolation (sometimes called station isolation or peer-to-peer blocking) configures the AP or controller to block or restrict direct forwarding of traffic between associated clients. On municipal guest networks it reduces lateral movement between patrons’ devices through the AP. Isolation is a forwarding policy—it does not by itself encrypt frames, issue certificates, or remove the need for appropriate WLAN security settings and higher-layer controls on city Wi-Fi. Claiming isolation encrypts all traffic with unique per-user WPA3-Enterprise certificates automatically confuses a bridging restriction with 802.1X cryptography. Saying isolation merges every client into one shared IBSS with unrestricted peer access describes the opposite of isolation. Asserting isolation disables beacons so neighboring cities cannot see the SSID invents a discovery-hiding side effect isolation does not provide. Exam caveat: Isolated open networks can still expose payloads to over-the-air eavesdropping; isolation is not confidentiality. Operational check: Under RoE on a guest SSID, verify whether client-to-client pings or shares fail while Internet or portal paths still work, and document isolation as a lateral-movement control separate from encryption mode.