A company wants to ensure that wireless guest networks cannot reach corporate internal resources. Which architectural control achieves this most effectively?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because placing the guest network on a separate VLAN with routing only to the internet and explicit deny rules for internal subnets provides network-level isolation regardless of what credentials a guest uses. A is wrong because a strong passphrase prevents unauthorized wireless access but does not restrict what an authorized guest can reach on the internal network.
Full explanation below image
Full Explanation
B is correct because placing the guest network on a separate VLAN with routing only to the internet and explicit deny rules for internal subnets provides network-level isolation regardless of what credentials a guest uses. A is wrong because a strong passphrase prevents unauthorized wireless access but does not restrict what an authorized guest can reach on the internal network. C is wrong because client isolation only prevents guest-to-guest communication, not guest-to-corporate access. D is wrong because a captive portal is an access control measure for the guest network itself, not a control preventing access to internal resources.