A factory's machine network must not share a VLAN with guest laptops that visitors bring onto the wireless network. Which design matches that requirement?
Select an answer to reveal the explanation.
Short Explanation
Guest laptops and factory machines should not sit in the same room just because the cable is convenient. You segment the machine network onto its own VLAN so a visitor's laptop is not a neighbor of a controller. Sharing the guest name, filtering at a gateway that still shares the VLAN, or blocking one laptop's hardware address does not create that separation.
Full Explanation
Segmentation places guests and machine controllers in different broadcast domains. The machine network gets its own VLAN, distinct from the guest laptops. Putting the machines on the guest wireless name does the opposite and shares the network for convenience. A firewall on the guest gateway is the tempting twin because it can block traffic. The machines are still in the guest VLAN, so a visitor is a neighbor of a controller before that gateway sees the frame. MAC filtering can stop one laptop from joining the radio. It does not move the machines off the guest VLAN. Exam caveat: a separate VLAN is not the whole control. Routing between the VLANs has to be denied or tightly filtered, or the split is only a label. Operational check: from a guest laptop, attempt to reach a machine address and confirm it fails, then confirm a maintenance station on the machine VLAN still reaches its controller. Deny routing from the guest VLAN to the machine VLAN, or the separate VLAN is only a label. Test from a guest laptop to a machine address and expect the attempt to fail.