A school wants visitors to see a sign-in page before they reach the internet, and those visitors must not join the staff VLAN. Which design fits?
Select an answer to reveal the explanation.
Short Explanation
Visitors should hit a front desk before they wander into the building. You put them on a guest network and stop them at a captive portal until they sign in, and you keep that network off the staff VLAN. Enterprise authentication without accounts, a tunnel into the staff network, or a guest VLAN with no sign-in page does not do that job.
Full Explanation
A guest wireless network is a separate network, with its own VLAN and addressing, so visitors never land on the staff VLAN. A captive portal intercepts the first web request and presents a sign-in or acceptance page before the client is allowed onto the internet. Together they match the school requirement: a page first, and no path onto the corporate VLAN. WPA3-Enterprise authenticates users with 802.1X against an account store. Visitors who have no school accounts cannot complete that exchange, so enterprise mode fails the audience even though it is strong security for staff. A site-to-site VPN connects two networks into one routed relationship. Using it to place guest laptops on the staff VLAN does the opposite of the isolation the school asked for. A guest VLAN with no portal does isolate visitors from the staff network, and it lets them straight onto the internet. The stem requires the sign-in page before that access. Exam caveat: a captive portal is not encryption. The guest radio still needs a wireless protection mode, or an open portal leaves the frames readable on the air. Operational check: associate a visitor device, confirm it receives a guest address rather than a staff address, confirm the first browse hits the sign-in page, and confirm it cannot reach a staff server before or after signing in except where policy explicitly allows.