A city uses dynamic VLAN assignment via RADIUS after successful staff EAP. What post-authentication capability does that demonstrate?
Select an answer to reveal the explanation.
Short Explanation
After the badge checks out, RADIUS can still say which hallway you get—VLAN or ACL attributes. That is authorization on top of authentication, not 'accept only' and not a substitute for encryption keys.
Full Explanation
Dynamic VLAN assignment via RADIUS after successful staff EAP demonstrates post-authentication authorization: RADIUS can return VLAN or ACL attributes that change user network posture after successful EAP without requiring a separate SSID for every role. RADIUS is not limited to a Boolean accept with no influence on network posture afterward. Dynamic VLANs do not replace the need for pairwise encryption keys on WPA2. Dynamic VLANs do not force all users onto the same captive-portal open SSID. Exam caveat: attribute correctness and fallback VLAN behavior matter; a mis-assigned VLAN can place civic users on overly trusted segments. Operational check: authenticate test personas representing staff roles, confirm resulting VLAN or ACL placement, and verify unknown users do not land on sensitive municipal subnets. For municipal and campus engagements, keep the finding language tied to authorized scope, name the building or SSID class affected, and state the residual risk to residents or staff if the rejected option had been chosen. Re-validate after the next change window that the selected control still matches inventory, monitoring, and RoE abort criteria used by the city wireless program.