A small company can only afford to buy an all-in-one wireless router/switch. The company has 3 wireless BYOD
users and 2 web servers without wireless access. Which of the following should the company configure to
protect the servers from the user devices? (Choose two.)

A.
Deny incoming connections to the outside router interface.

B.
Change the default HTTP port

C.
Implement EAP-TLS to establish mutual authentication

D.
Disable the physical switch ports

E.
Create a server VLAN

F.
Create an ACL to access the server

Explanation:
We can protect the servers from the user devices by separating them into separate VLANs (virtual local area
networks).
The network device in the question is a router/switch. We can use the router to allow access from devices in
one VLAN to the servers in the other VLAN. We can configure an ACL (Access Control List) on the router to
determine who is able to access the server.
In computer networking, a single layer-2 network may be partitioned to create multiple distinct broadcast
domains, which are mutually isolated so that packets can only pass between them via one or more routers;
such a domain is referred to as a virtual local area network, virtual LAN or VLAN.
This is usually achieved on switch or router devices. Simpler devices only support partitioning on a port level (if
at all), so sharing VLANs across devices requires running dedicated cabling for each VLAN. More sophisticated
devices can mark packets through tagging, so that a single interconnect (trunk) may be used to transport data
for multiple VLANs.
Grouping hosts with a common set of requirements regardless of their physical location by VLAN can greatly
simplify network design. A VLAN has the same attributes as a physical local area network (LAN), but it allows
for end stations to be grouped together more easily even if they are not on the same network switch. The
network described in this question is a DMZ, not a VLAN.