220-1102 Question 549
Single answerConfiguring guest accessA small medical office wants to provide Wi-Fi access to patients in the waiting room. Staff members use the same wireless infrastructure to access internal file shares and the electronic health record system. The office manager asks you to configure guest access so patients can get on the internet, but they must not be able to reach any internal office resources. Which action is the BEST way to meet this requirement?
- A
Create a separate guest SSID that is isolated from the internal LAN and allows internet-only access
- B
Give patients the password to the staff wireless network and rely on file-share permissions to block access
- C
Disable SSID broadcast on the staff wireless network and let patients connect to it manually
- D
Configure MAC address filtering for patient devices on the staff wireless network
Show answer and explanation
Correct answer: A
Explanation
The safest and most practical solution is to configure a dedicated guest network that is separated from the internal business network and restricted to internet access only. This aligns with standard wireless security best practices and the intent of protecting sensitive organizational resources from untrusted devices. In environments handling confidential data, such as a medical office, guest users should never be placed on the same SSID or network segment as staff systems. Vendor documentation for business-class wireless equipment commonly describes guest networks as separate SSIDs with client isolation, VLAN separation, and firewall rules that block access to the internal LAN while permitting outbound internet access. CompTIA A+ Core 2 expects candidates to recognize that proper guest access depends on network isolation, not simply hiding the SSID, sharing credentials, or using MAC filtering.
- A. Correct.
Correct. The best practice for guest access is to place guests on a separate wireless network or guest SSID that is logically isolated from the organization's internal network. On business-class routers and access points, guest networks are commonly mapped to a separate VLAN or otherwise restricted so clients can reach the internet but not internal resources. This directly addresses the requirement to provide access while preventing exposure of file shares and sensitive systems.
- B. Incorrect.
Incorrect. Sharing the staff wireless network with guests is not an appropriate guest access configuration. Even if file-share permissions are set correctly, guests would still be on the same trusted network segment and could potentially discover or attempt to access internal services, printers, or other devices. This option reflects a common mistake: relying only on application-level permissions instead of proper network segmentation.
- C. Incorrect.
Incorrect. Disabling SSID broadcast does not create security or guest isolation. A hidden SSID can still be discovered, and if patients are placed on the staff network, they would still be connected to the same internal environment. This choice confuses obscuring the network name with actually controlling access.
- D. Incorrect.
Incorrect. MAC filtering is not a strong or practical guest access solution. MAC addresses can be spoofed, and maintaining an allowlist for many temporary patient devices would create unnecessary administrative overhead. It also does not solve the core requirement of separating guests from internal resources if they are still joining the staff network.