Because these are Wi-Fi-enabled environmental sensors, they are effectively IoT/embedded devices that often have limited security controls, inconsistent patch support, and may expose management interfaces or services.
A common Security+ best practice is to reduce their attack surface and limit lateral movement by placing them in a separate, protected network segment and tightly controlling what they can talk to (for example, only to the metrics collector/broker). The Study Guide explicitly calls out VLAN-based segmentation for IoT as a hardening technique: "A common technique used in hardening networks is the use of VLANs... Placing IoT devices on a separate, protected VLAN with appropriate access controls... can help to ensure that frequently vulnerable devices are more protected." It also reinforces this in a practice question scenario: "What security control should she recommend...? ... Deploy the IoT devices to a protected VLAN." Why the other options are less likely:
* A (risk register) is governance documentation, not the most likely immediate technical control for deployment.
* C (air gap) is usually unrealistic for Wi-Fi sensors that must transmit metrics.
* D (TLS 1.2) may be beneficial, but many sensors can't support strong crypto consistently; segmentation is the most broadly applicable first move to contain risk.
References: CompTIA Security+ Study Guide (SY0-701) - Network Hardening/VLAN segmentation guidance ; related IoT hardening practice question recommending a protected VLAN .