mediumMultiple ChoiceObjective-mapped
220-1201 Practice Question: Setting up a guest wireless network in a…
A company is setting up a guest wireless network in a conference room. They want to ensure that guests can access the internet but cannot communicate with internal corporate devices. The network uses a single router and a switch. Which configuration on the router will best achieve this?
⚠ Common exam trap
The 220-1201 exam often tests the misconception that disabling SSID broadcast or using DHCP alone provides security, when in fact VLANs with ACLs are required for true network segmentation and access control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a separate VLAN for the guest network and apply an ACL to block traffic to the internal network.
Creating a separate VLAN for the guest network isolates guest traffic at Layer 2, and applying an ACL on the router's VLAN interface blocks traffic destined for the internal network while permitting internet-bound traffic. This ensures guests cannot reach internal corporate devices, meeting the security requirement without additional hardware.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the router to use DHCP for the guest network.
Why it's wrong here
Configuring DHCP on a router for a guest network solely provides IP address assignment services to devices. It does not inherently create network segmentation or isolation between different user groups. If the guest network remains on the same logical subnet as internal devices, DHCP will not prevent guests from attempting to communicate with or access internal resources, as it operates at a different layer of network functionality than security isolation.
- ✓
Create a separate VLAN for the guest network and apply an ACL to block traffic to the internal network.
Why this is correct
Creating a separate Virtual Local Area Network (VLAN) for the guest network logically isolates its traffic from the internal network at Layer 2. This segmentation prevents direct communication between guests and internal devices by default. Applying an Access Control List (ACL) on the router then explicitly defines traffic rules, allowing guests internet access while specifically blocking any attempts to reach internal network subnets, thereby enforcing robust security and isolation.
- ✗
Disable the SSID broadcast for the guest network.
Why it's wrong here
Disabling the SSID broadcast for a guest network is a form of security through obscurity, which offers minimal protection. While it makes the network less visible to casual users, it does not prevent determined individuals from discovering the SSID using readily available network scanning tools. Crucially, hiding the SSID provides no network segmentation or access control, meaning if a guest connects, they would still be on the same logical network and potentially able to access internal resources unless other isolation measures are in place.
- ✗
Use a wireless access point with a built-in firewall.
Why it's wrong here
While a wireless access point with a built-in firewall could offer some level of traffic filtering, this solution introduces additional hardware and complexity not specified as part of the existing infrastructure (a single router and switch). The most efficient and integrated approach for network segmentation and access control, leveraging the router's capabilities, involves VLANs and ACLs. Relying on a WAP's firewall might also lead to inconsistent security policies if not centrally managed with the main network's security posture.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 972 original 220-1201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1201 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1201 exam.