A city guest portal rides open/captive access while staff use WPA2-Enterprise on the same AP hardware. What multi-SSID security judgment matters most for assessment and design advice?
Select an answer to reveal the explanation.
Short Explanation
One box, two worlds: guest open portal and staff Enterprise can share AP silicon without sharing trust. The win is isolation so a lobby compromise does not stroll into staff VLANs. Do not force everyone onto the weakest model just because the AP is shared.
Full Explanation
When a city guest portal rides open or captive access while staff use WPA2-Enterprise on the same AP hardware, the multi-SSID security judgment that matters most is that the same AP can host different security models, so designers must ensure a guest compromise cannot bridge into the staff network. Same AP hardware does not mean guest and staff must share one encryption key by 802.11 rules. Open guest SSIDs do not automatically inherit Enterprise certificates from the staff SSID. Assessors should not disable Enterprise on staff until guests also use PEAP. Exam caveat: SSID coexistence is normal; isolation evidence at VLAN and firewall layers is the control that makes coexistence safe for municipal services. Operational check: associate as guest in a civic building, test reachability toward staff subnets and management planes, and document ACLs or VRF-style separation that keep resident guest traffic off staff resources. For municipal and campus engagements, keep the finding language tied to authorized scope, name the building or SSID class affected, and state the residual risk to residents or staff if the rejected option had been chosen. Re-validate after the next change window that the selected control still matches inventory, monitoring, and RoE abort criteria used by the city wireless program.