A city segments the staff Enterprise SSID from an open guest networ…

Question

A city segments the staff Enterprise SSID from an open guest network. What architecture hygiene does that separation primarily enforce?

Accepted Answer

Staff 802.1X and guest networks should be separate SSIDs and VLANs with different trust levels. — Staff Enterprise and open guest should live on different doors and different hallways—separate SSIDs and VLANs with different trust. Do not mash them into one PSK or one AD group story.

Answer

It forces guest devices to complete PEAP-MSCHAPv2 before receiving a DHCP lease.

Answer

It allows one shared PSK to authorize both staff EAP and guest captive-portal users.

Answer

It merges RADIUS accounting so guest MAC addresses inherit staff Active Directory groups.

A city segments the staff Enterprise SSID from an open guest network. What architecture hygiene does that separation primarily enforce?

Short Explanation

Full Explanation