Question 640
The team at a coastal resort has corrected this condition: The identity team creates a policy for a client device tag, but the tag is never attached to target clients so the rule does not trigger. Which preventive practice BEST addresses the identified mechanism?
Explanation
Correct Answer
Reconcile client label assignments whenever changing policy conditions. This repeatable safeguard addresses the mechanism—policy intent is ineffective if match labels are absent or mis-scoped—and reduces the chance that the specific fault recurs.
Incorrect Answers
Review policy precedence and run negative cases after every WxLAN rule edit. This protects against another issue—a support team inserts a broad allow rule above a specific deny rule and observes contractors bypass the restricted-resource rule—but is not the most direct prevention for the identity team creates a policy for a client device tag, but the tag is never attached to target clients so the rule does not trigger.
Test both allowed and denied flows for every WxLAN user class. This protects against another issue—a contractor with the correct WLAN password can reach a production database because the WxLAN policy defaults to allowing all unmatched resources—but is not the most direct prevention for the identity team creates a policy for a client device tag, but the tag is never attached to target clients so the rule does not trigger.
Include PMF negotiation in security acceptance and legacy-client compatibility testing. This protects against another issue—a network engineer disables protected management frames while deploying a WPA3 WLAN to improve compatibility—but is not the most direct prevention for the identity team creates a policy for a client device tag, but the tag is never attached to target clients so the rule does not trigger.