easyMultiple ChoiceObjective-mapped
220-1201 Practice Question: A small business owner wants to set up a guest…
A small business owner wants to set up a guest Wi-Fi network that is isolated from the main corporate network to prevent unauthorized access to sensitive data. The wireless router supports multiple SSIDs. Which configuration should be applied to achieve this isolation?
⚠ Common exam trap
Many exam-takers confuse 'different SSID name' with actual network isolation, assuming a separate name alone creates a separate broadcast domain, when in fact VLAN assignment is required for Layer 2 separation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the guest SSID to a different VLAN
Assigning the guest SSID to a different VLAN (Virtual Local Area Network) creates a logical separation between the guest traffic and the corporate network. VLANs operate at Layer 2, and by placing the guest SSID on a separate VLAN, the router can apply inter-VLAN ACLs or disable routing between VLANs entirely, ensuring that guest devices cannot access corporate resources. This is the standard method for network isolation in multi-SSID environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign the guest SSID to a different VLAN
Why this is correct
This is the correct approach for network segmentation. A Virtual Local Area Network (VLAN) logically separates network traffic at Layer 2 (Data Link Layer) of the OSI model, even if devices are connected to the same physical switch or access point. By assigning the guest SSID to a distinct VLAN, guest devices receive IP addresses from a separate subnet and are prevented from directly communicating with devices on the corporate VLAN, thereby enhancing security and isolating resources. This ensures that guest users cannot access internal company servers or sensitive data.
- ✗
Use a different SSID name for guests
Why it's wrong here
While using a different Service Set Identifier (SSID) makes it easier for users to identify the guest network, it provides no inherent security or traffic isolation. Both the guest and corporate SSIDs could still be mapped to the same broadcast domain and IP subnet, allowing guest devices to potentially access internal corporate resources. An SSID is merely a network name and does not implement any form of Layer 2 or Layer 3 segmentation.
- ✗
Enable WPA2 encryption on the guest network
Why it's wrong here
Enabling WPA2 (Wi-Fi Protected Access II) encryption is crucial for securing the wireless communication link itself, protecting data transmitted between the client and the access point from eavesdropping. However, encryption does not perform network segmentation. Once a guest device authenticates and connects, WPA2 does not prevent it from accessing other devices or resources on the same network segment or broadcast domain as the corporate devices, if no further isolation mechanisms are in place.
- ✗
Disable DHCP on the guest SSID
Why it's wrong here
Disabling Dynamic Host Configuration Protocol (DHCP) on the guest SSID would prevent guest devices from automatically obtaining an IP address, subnet mask, default gateway, and DNS server information. Without this essential configuration, guest devices would be unable to communicate on the network or access the internet, effectively rendering the guest network unusable. While it would prevent access to corporate resources, it does so by completely disabling network functionality for guests, which is not the desired outcome of providing guest access.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Configuration: IP, DNS, DHCP
Key term
Wi-Fi
Wi-Fi is a technology that lets devices like laptops and phones connect to the internet or communicate with each other wirelessly using radio waves.
Key term
Local Area Network
A Local Area Network (LAN) connects computers and devices within a small physical area, such as a home, office, or school, allowing them to share resources like files, printers, and internet access.
About these practice questions
This 220-1201 question is part of Courseiva's 972-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1201 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1201 exam.