County IT wants guest Wi-Fi traffic kept out of the campus core and terminated in a DMZ. Which approach best supports that isolation goal?

County IT that wants guest Wi-Fi traffic kept out of the campus core and terminated in a DMZ should tunnel guest WLAN traffic to a DMZ concentrator so isolation happens off the campus core. Guests remain useful for Internet access while their packets avoid wandering through finance and staff switching layers. Tunneling to a DMZ is a classic WLAN-supporting security pattern for municipal campuses that must host visitors without extending trust inward. Mapping guest SSIDs onto the same VLAN as finance servers for easier routing collapses isolation for operational convenience. Allowing guests unrestricted Layer-2 adjacency to staff APs without tunneling invites lateral movement and simplifies reconnaissance. Storing guest PSK material only on edge printers instead of using network controls misunderstands both credential hygiene and traffic isolation. Exam caveat: the DMZ path still needs egress controls, DHCP/DNS hygiene, and monitoring—tunneling alone is not a complete guest security program. Operational check: from a guest client, traceroute or capture the path toward the Internet and confirm traffic leaves via the DMZ concentrator rather than hairpinning through core staff VLANs; attempt staff subnet reachability and verify it fails at the DMZ policy point.