Question 530
After a change at an industrial warehouse, the original incident was: A contractor with the correct WLAN password can reach a production database because the WxLAN policy defaults to allowing all unmatched resources. Which evidence BEST verifies that the specific failure has been corrected?
Explanation
Correct Answer
Contractors reach permitted services and are denied the production database in negative tests. This directly checks the outcome of the chosen remediation and confirms the problem was not merely hidden. The diagnostic issue was: a permissive final policy row or incomplete resource set can override intended segmentation.
Incorrect Answers
The client receives the intended final VLAN after both RADIUS and WxLAN decisions. This would demonstrate a different scenario was fixed—a WxLAN VLAN override silently supersedes a RADIUS dynamic VLAN and moves an authorized employee to an unexpected segment—but does not validate recovery from a contractor with the correct WLAN password can reach a production database because the WxLAN policy defaults to allowing all unmatched resources.
A representative contractor request matches the intended restrictive rule before any broad allowance. This would demonstrate a different scenario was fixed—a support team inserts a broad allow rule above a specific deny rule and observes contractors bypass the restricted-resource rule—but does not validate recovery from a contractor with the correct WLAN password can reach a production database because the WxLAN policy defaults to allowing all unmatched resources.
The physical AP broadcasts the intended WLAN after cloud synchronization. This would demonstrate a different scenario was fixed—a WLAN configuration appears correct in the portal but a powered-off AP has not received its updated broadcast settings—but does not validate recovery from a contractor with the correct WLAN password can reach a production database because the WxLAN policy defaults to allowing all unmatched resources.