ISC2 CC Network Security Practice Question
A retail chain wants to prevent customers on its guest wireless from reaching point-of-sale terminals on the corporate wired network, while still allowing guests to browse the internet. The chain already separates the two networks with a firewall. Which additional configuration most directly enforces this restriction?
⚠ Common exam trap
The trap here is assuming that stronger wireless encryption or key rotation isolates guests from internal systems, when the restriction must be enforced by filtering routed traffic between the subnets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the firewall to deny traffic from the guest wireless subnet to the point-of-sale subnet while permitting outbound internet access
Because the networks are already separated by a firewall, the restriction is enforced by a rule that denies guest-subnet traffic destined for the point-of-sale subnet while still allowing internet access. This places the control at the routing boundary where it can be logged and audited, rather than relying on wireless-layer measures that only affect the radio link.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the firewall to deny traffic from the guest wireless subnet to the point-of-sale subnet while permitting outbound internet access
Why this is correct
An explicit deny from the guest subnet to the point-of-sale subnet, paired with a permit for internet-bound traffic, enforces the exact requirement at the boundary between the two networks. Because the firewall already separates them, this rule is the direct and auditable control that prevents guests from initiating sessions to the terminals.
- ✗
Enable WPA3 encryption on the guest wireless network
Why it's wrong here
WPA3 protects the wireless link between the guest device and the access point, preventing eavesdropping on that radio segment. It does not govern where a guest may route after joining, so a guest with valid credentials could still attempt to reach the point-of-sale subnet if the firewall permits it.
- ✗
Change the guest wireless pre-shared key on a monthly schedule
Why it's wrong here
Rotating the guest key limits how long a former guest retains wireless access, but any current guest still holds the key and could attempt to reach the point-of-sale subnet. Key rotation does not restrict routed traffic between subnets, so it does not enforce the required isolation.
- ✗
Deploy a wireless intrusion prevention system to detect rogue access points
Why it's wrong here
A wireless IPS detects and can contain unauthorized access points and some wireless attacks, which is valuable for radio-frequency hygiene. It has no authority over routed traffic between the guest subnet and the point-of-sale subnet, so it cannot enforce the segmentation the retailer requires.
Visual reference
Go deeper
Related to this question
Learn chapter
Access Control Fundamentals
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.