A county library kiosk VLAN must enroll devices in Workspace ONE UEM through AirWatch Cloud Connector but must not browse the open internet. Which firewall design meets both goals?
Select an answer to reveal the explanation.
Short Explanation
Library kiosks need a hallway to the enrollment desk, not a door to the whole internet. Allow the UEM enrollment, device-services, and AWCM paths, and stop there.
Full Explanation
A county library kiosk VLAN must enroll in Workspace ONE UEM through AirWatch Cloud Connector without open-internet browsing. Allow only enrollment, device-services, and AWCM destinations from that VLAN—a hallway to the enrollment desk, not a door to the whole internet. Permit-any outbound TCP 443 fails by concept because it conflates enrollment enablement with general web access and lets kiosks browse arbitrary destinations. Deny-all outbound including ACC fails because enrollment and device services cannot complete without those documented paths. Opening SMB and RDP from the kiosk VLAN to the ACC host fails because file-share and remote-desktop protocols are not the enrollment control channel and widen lateral movement onto the connector. Exam caveat: Workspace ONE enrollment uses scoped FQDN and port allows (including ACC/AWCM/device services)—not "443 anywhere" and not host-admin protocols to ACC. Operational check: enroll a kiosk successfully, confirm Hub or device check-in against allowed destinations, attempt a random internet browse and verify block, and ensure SMB/RDP to ACC stay denied from the kiosk VLAN. Document the destination set in the library change record so seasonal SSID moves do not reopen full internet on those devices.