OpenCyber AcademyLesson map
Lesson 09. Map, example, EX055.
flowchart TD
G["guest_network = True"] --> P["PASS guest network enabled"]
I["guest_isolated_from_lan = False"] --> F["FIX guest isolated from business devices"]
P --> S["A name can exist while forwarding still joins the LAN"]
F --> S
The two booleans are neighbours in the dictionary and opposites in the result.
Logical drawing
guest network enabled PASS
guest isolated from business FIX
speaker and scanner still on the lease print
Learning outcomes
After this chapter, you should be able to:
- State what an SSID name does and what an isolation flag does.
- Keep both guest booleans.
- Keep the speaker and the scanner on the lease print.
9.1 Selecting a name and refusing a forward are different controls.
A wireless client chooses a network by its advertised name, the SSID. Enabling a guest network means that name is offered. It does not, by itself, state what the router does with a frame after the client has associated. Isolation from the local network is a forwarding rule: traffic from guest clients is not delivered onto the business LAN, and often is not delivered to other guest clients either. The dictionary records the two decisions separately. guest_network is true, so the existence check passes. guest_isolated_from_lan is false, so the isolation check prints FIX. Collapsing those into "the guest network is done" erases the control that chapter 1 said was missing.
Chapter 3's recommendation depends on that second flag. The speaker and the scanner share the printed network with the tills, and Leo recommends moving them to the guest network once it is isolated. "Once" is a condition. The condition is false in the settings dictionary. Chapter 4's narrative later says isolation was turned on and the two devices were moved, after closing, with Ellen approving the step. That narrative is a change log in prose. It does not edit guest_isolated_from_lan, and it does not delete bb:77 or cc:19 from the lease print. A reader who wants the after picture has to say "the report describes a later change." A reader who wants the measured before picture has to quote the FIX line.
NIST SP 800-153's reason for a separate guest network is the same reason as the bakery drawing: visitors should not be on a path to the devices that take payment and hold accounts. A second name without the forwarding barrier does not meet that reason. The barrier, once described as done, still wants the limited connection check in chapter 4. This chapter does not perform that check. It only stops the two flags being treated as one.
9.2 Worked example
Lesson table; scroll horizontally to read all columns →
| Pair | Before dictionary | Decision |
|---|---|---|
| Guest network exists | True, and the line passes | May stay |
| Isolated from the LAN | False, and the line is FIX | May stay |
| Speaker and scanner rows | Still UNKNOWN on the lease print | May stay |
| "Isolation was already true because the guest name existed." | Contradicts the boolean | Refuse |
Synthetic case. The move of the speaker and the scanner stays in the narrative.
Errors and limits
A condition written as "once it is isolated" is evidence that isolation was not the starting state.
Apply
- EX055 — Which guest flag passes? The print shows the guest network enabled and guest isolation still to fix. The story later moves the speaker and the scanner. What does the before dictionary say, and what stays on the lease print?
Show marking criteria
Rubric: 3 = existence passes and isolation fails; the two booleans stay different; bb:77 and cc:19 stay on the lease print; the move stays prose;; 2 = the FIX line stays and the lease rows stay;; 1 = the name only;; 0 = none.