A city NAC solution finds employee laptops missing required patches and disk encryption before they join the staff Wi-Fi. Where should those devices be placed until posture checks pass?

Network Access Control (NAC) evaluates device posture—patches, disk encryption, and similar health signals—before granting normal staff Wi-Fi access. When a city laptop fails those checks, the correct placement is a quarantine (remediation) VLAN that offers only the limited connectivity needed to patch, enroll encryption, or reach remediation services, not unrestricted reachability into production municipal networks. That design balances security and usability: employees can become compliant without being handed a free pass into finance, HR, or operational systems while their endpoint remains unhealthy.

Granting full production VLAN access despite failed posture checks defeats the purpose of NAC and exposes city systems to vulnerable or unencrypted endpoints. Permanently revoking the Active Directory account for any failed check confuses device hygiene with identity termination and creates operational chaos for users whose only issue is a missing patch. Bridging noncompliant devices onto the SCADA VLAN for 'faster patching' is especially dangerous—OT/SCADA segments must stay tightly controlled, not used as a convenience patch network for unhealthy IT laptops.

Exam caveat: quarantine is temporary and scoped; it is not permanent exile, and remediation portals must themselves be hardened. Also remember that NAC posture is complementary to authentication—passing identity checks does not equal passing health checks.

Operational check: validate that quarantine ACLs allow only remediation destinations (update servers, MDM/NAC agents, DNS as needed), deny lateral paths to production and SCADA, and confirm devices automatically reassess and move to the staff VLAN only after posture checks pass.