Election tabulation gear must stay isolated from the county office network. How do an air-gapped lab and a logically segmented VLAN differ?

An air-gapped election tabulation lab has no intentional network path to other county systems: isolation is achieved by absence of connectivity (and strict media-control procedures), which is why air gaps remain a strong architectural choice for high-integrity election equipment. A VLAN provides logical segmentation on shared switching infrastructure; isolation depends on correct VLAN assignment, trunk configuration, ACL/firewall policy, and administrative hygiene. Both can support separation goals, but they are not equivalent: VLAN isolation can fail through misconfiguration, double tagging, compromised switches, or overly broad trunks, whereas a true air gap removes the network attack path entirely (while introducing its own removable-media risks).

Treating an air gap and a VLAN as identical because both may use Ethernet hardware confuses physical media with topology and policy. Claiming a VLAN is stronger than an air gap because VLANs cannot be misconfigured is inverted—configuration error is a primary VLAN failure mode. Requiring continuous Internet monitoring agents on every air-gapped tabulation workstation contradicts air-gap intent by introducing connectivity and external software supply chains.

Exam caveat: Security+ distinguishes physical/air-gap isolation from logical segmentation; do not equate VLAN tags with yanking the cable. Operationally for elections, document which systems are truly air-gapped, control USB and update media with integrity checks, and if VLAN segmentation is used elsewhere, continuously validate trunk allow-lists and that election VLANs have no routed path to office networks.