A company wants to use new Wi-Fi-enabled environmental sensors in order to automatically collect metrics.

Because these are Wi-Fi–enabled environmental sensors, they are effectively IoT/embedded devices that often have limited security controls, inconsistent patch support, and may expose management interfaces or services. A common Security+ best practice is to reduce their attack surface and limit lateral movement by placing them in a separate, protected network segment and tightly controlling what they can talk to (for example, only to the metrics collector/broker). The Study Guide explicitly calls out VLAN-based segmentation for IoT as a hardening technique: “A common technique used in hardening networks is the use of VLANs… Placing IoT devices on a separate, protected VLAN with appropriate access controls… can help to ensure that frequently vulnerable devices are more protected.” It also reinforces this in a practice question scenario: “What security control should she recommend…? … Deploy the IoT devices to a protected VLAN.”

Why the other options are less likely:

A (risk register) is governance documentation, not the most likely immediate technical control for deployment.

C (air gap) is usually unrealistic for Wi-Fi sensors that must transmit metrics.

D (TLS 1.2) may be beneficial, but many sensors can’t support strong crypto consistently; segmentation is the most broadly applicable first move to contain risk.