A library guest Wi-Fi SSID is bridged into the same VLAN as staff workstations with no client isolation, allowing a visitor laptop to reach clerk file shares. Which threat vector best describes this condition?
Select an answer to reveal the explanation.
Short Explanation
Guest Wi-Fi that can see staff shares is an unsecure wireless / segmentation failure — visitors should not share the clerk VLAN. This is network attack surface, not BEC or a poisoned vendor update. Segment guests, enable isolation, and keep staff off the public SSID.
Full Explanation
Unsecure wireless and poor segmentation expose staff networks when guest SSIDs share VLANs or bridging with employee resources and lack client isolation. A library visitor on guest Wi-Fi who can reach clerk file shares has crossed a trust boundary that should never exist. The threat vector is network design: wireless convenience without isolation turns every guest laptop into a potential insider on the staff segment.
Business email compromise via a lookalike vendor domain is email payment fraud. It does not describe Layer-2/Layer-3 adjacency between guest Wi-Fi and staff shares.
Buffer overflow in a legacy scanning daemon is a memory-corruption application flaw. Wireless bridging into a staff VLAN is a network architecture failure, not an input parser bug.
A malicious update in a software vendor’s build pipeline is a software supply-chain attack. Guests reaching clerk shares through shared wireless infrastructure is unrelated to poisoned vendor updates.
Exam caveat: Look for language about guest/staff coexistence, missing client isolation, shared VLANs, or bridging—those map to unsecure wireless / poor segmentation. Do not answer with malware types when the stem is pure network exposure. Guest networks should be treated as hostile.
Operational check: place guest Wi-Fi on isolated SSIDs and VLANs with client isolation enabled, firewall guests away from staff file shares and domain controllers, use separate DHCP/DNS where practical, and periodically validate that captive portals cannot hairpin into municipal internal networks. Document library wireless as a public-access zone with explicit deny rules toward clerk systems.