A bank wants branch guest sessions to terminate on a controller in the DMZ, not on the branch employee VLAN. Each branch already has its own controller. Which guest design places that traffic on the DMZ controller?
Select an answer to reveal the explanation.
Short Explanation
The guest anchor is a private hallway from the branch lobby to the DMZ, not a seat on the employee VLAN. Your branch controller stays the place guests associate, and it tunnels those sessions to the anchor. A different channel does not move the VLAN.
Full Explanation
A guest anchor, also called a mobility anchor, makes the branch controller the foreign controller where guests associate, and tunnels those sessions to the anchor controller in the DMZ. The guest VLAN and the guest exit to the internet live at the anchor, so guest traffic never joins the branch employee VLAN. That is the design the bank asked for. Bridging the guest SSID onto the employee VLAN is the failure mode the requirement forbids. The guests would be in the employee broadcast domain at the branch, regardless of the SSID name. Monitor mode only listens. It does not associate guests and it does not tunnel them anywhere. An RF profile can give the guest WLAN a different channel from another WLAN, but channel separation is not Layer 3 isolation and it does not terminate the session in the DMZ. The clients would still land on whatever VLAN the policy profile maps. Exam caveat: both controllers need a working mobility relationship, and DHCP for the guests has to make sense at the anchor, where the session is actually terminated. Operational check: associate a test guest at a branch and confirm the session is anchored to the DMZ controller and that the address comes from the DMZ guest scope.