Secure Guest, BYOD and Guest Network Design
This domain tests how to give visitors and unmanaged devices network access without widening the corporate attack surface. Questions typically supply a population of users or device types and ask you to select authentication, segmentation, and onboarding controls that fit.
Guest network design rules
Guest traffic gets its own SSID, VLAN, subnet, and firewall zone with an explicit deny to internal RFC1918 space and a default route to the internet only. Add DNS filtering, bandwidth caps, and client isolation so guests cannot reach one another. Authentication choices range from a captive portal with sponsor approval or self-registration, to WPA3-SAE with per-guest credentials, to OWE on open networks. OWE encrypts the link but does not authenticate the network, so it does not stop an evil twin; it only stops passive eavesdropping. Never reuse a corporate pre-shared key for guests. Passpoint and Hotspot 2.0 use 802.11u and ANQP to onboard partner and carrier credentials automatically. Apply time-bound accounts, terms-of-service acceptance, and logging for abuse investigation. Remember that modern phones randomize MAC addresses per SSID, so MAC cannot serve as identity or accounting key.
BYOD controls
True BYOD onboarding means certificate-based 802.1X with EAP-TLS, distributing certificates through SCEP, EST, or an MDM. Network access control adds posture checks such as patch level, antimalware, and disk encryption, with a remediation VLAN for failing devices. Segment by device class and apply ACLs that permit only the applications that class needs. Devices that cannot do 802.1X, such as printers, cameras, and medical equipment, should get per-device pre-shared keys on an isolated VLAN with scheduled rotation, or DPP for headless onboarding. Corporate data containers and conditional access limit what a lost personal phone exposes, and remote wipe should remove only the corporate payload.
Worked example
A hospital needs guest Wi-Fi for patients and BYOD for 400 staff phones. Guests go on a dedicated VLAN with client isolation, an SMS-registration captive portal, four-hour sessions, and a 10 Mbps cap. Staff phones authenticate with EAP-TLS using certificates pushed by the MDM and land on a segmented VLAN with ACLs to clinical applications only. Legacy infusion pumps receive per-device pre-shared keys on a third VLAN with static reservations and no internet route.
Traps that cost marks
- Sharing a VLAN between guests and employees and relying on a firewall rule as the only control.
- Treating MAC filtering as guest authentication.
- Deploying one PSK across hundreds of BYOD devices and calling the result secure.
- Assuming OWE protects guests from an evil twin.