SSCP Network and Communications Security Practice Question
A small business wants to let visitors use its guest Wi-Fi without exposing internal servers. The visitors must reach the internet only, while employees keep using the corporate SSID. Which design best isolates guest traffic from the internal network?
⚠ Common exam trap
The trap here is equating wireless client isolation with network segmentation, when isolation only blocks station-to-station traffic on the same SSID.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place guest clients on a separate VLAN whose only permitted path is to the internet gateway, with ACLs blocking access to internal subnets
Guest isolation requires separating traffic at Layer 2 and controlling it at Layer 3. A dedicated VLAN removes guests from the corporate broadcast domain, and ACLs or firewall rules that permit only internet-bound flows prevent lateral movement to internal servers. Encryption, client isolation, and MAC filtering affect who may join or talk to peers, but none of them keeps an associated guest away from internal subnets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable MAC filtering on the guest access points so only registered visitor devices may associate
Why it's wrong here
MAC filtering restricts which devices can join, but MAC addresses are easily spoofed and the filter says nothing about where traffic may go afterward. An allowed device still lands on the same network as internal systems. It adds administrative overhead without providing the required isolation, so it does not satisfy the scenario.
- ✗
Keep guests on the corporate SSID but enable client isolation so wireless clients cannot talk to each other
Why it's wrong here
Client isolation prevents wireless stations on the same SSID from communicating with one another, which stops peer-to-peer attacks. However, guests would still be on the corporate VLAN and could reach wired internal servers, since isolation applies only to wireless-to-wireless traffic. Guests would therefore remain a risk to internal systems, so this design does not meet the requirement.
- ✓
Place guest clients on a separate VLAN whose only permitted path is to the internet gateway, with ACLs blocking access to internal subnets
Why this is correct
A dedicated guest VLAN creates a distinct Layer 2 broadcast domain, and ACLs on the router or firewall restrict that VLAN to internet-bound traffic only. Because guest frames never share a segment with corporate hosts and routing rules deny internal destinations, a compromised visitor device cannot reach internal servers. This directly matches the requirement while keeping employee traffic untouched.
- ✗
Configure the guest SSID to use WPA3-Personal with a strong passphrase and rotate it monthly
Why it's wrong here
Strong wireless encryption protects the over-the-air link and prevents unauthorized associations, but every guest who knows the passphrase joins the same network as corporate users. Once connected, a guest can attempt to reach internal hosts. Encryption is not segmentation, so this approach does not isolate visitor traffic from internal resources.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.