easyMultiple ChoiceObjective-mapped
CISSP Deploying a wireless network for guests Practice Question
A company is deploying a wireless network for guests. The security requirement is to provide internet access only, with no access to the internal corporate network. Which technology should be used?
⚠ Common exam trap
Many exam-takers confuse strong authentication (WPA2-Enterprise or WPA3) with network segmentation, failing to realize that authentication alone does not enforce access boundaries between guest and corporate networks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A separate guest VLAN with ACLs restricting access to internal networks
A separate guest VLAN with ACLs restricting access to internal networks is the correct choice because it provides network segmentation at Layer 2 (VLAN) and Layer 3/4 (ACLs), ensuring guest traffic is isolated from the corporate network while allowing internet access. This approach aligns with the principle of least privilege and is a standard best practice for guest wireless deployments, as it does not rely on authentication or encryption alone to enforce access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
WPA3-SAE
Why it's wrong here
WPA3-SAE (Simultaneous Authentication of Equals) provides robust cryptographic protection for the wireless connection itself, ensuring data confidentiality and integrity between the client and the access point. However, its primary function is securing the wireless link and authenticating devices to the network, not enforcing network segmentation or restricting access to specific internal resources. Once a guest device is authenticated and connected via WPA3-SAE, it would still have access to any network segments reachable from that access point unless further Layer 2 or Layer 3 controls are implemented.
- ✗
MAC address filtering
Why it's wrong here
MAC address filtering attempts to control network access by allowing or denying devices based on their unique hardware addresses. While it can prevent unauthorized devices from initially connecting, it is easily circumvented by MAC address spoofing and does not provide any segmentation or access control once a device is connected. Furthermore, it is operationally cumbersome to manage for a dynamic guest network and offers no protection against guests attempting to access internal network resources.
- ✓
A separate guest VLAN with ACLs restricting access to internal networks
Why this is correct
This solution effectively addresses the requirement for guest network security by combining two critical controls. A separate guest Virtual Local Area Network (VLAN) logically isolates guest traffic from the company's internal network at Layer 2, preventing direct communication. Access Control Lists (ACLs) are then applied at Layer 3 on routing interfaces or firewalls to explicitly block guest VLAN traffic from reaching internal IP subnets while permitting access to the internet, ensuring robust segmentation and policy enforcement.
- ✗
WPA2-Enterprise with 802.1X
Why it's wrong here
WPA2-Enterprise with 802.1X provides robust, centralized authentication for wireless clients, typically integrating with a RADIUS server to verify user or device identities. While it offers strong authentication and can assign users to specific VLANs post-authentication (dynamic VLAN assignment), the protocol itself primarily focuses on verifying who is connecting. Without explicit configuration to place guests into a segregated VLAN and apply ACLs, WPA2-Enterprise alone does not inherently isolate guests from internal network resources.
Visual reference
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.