A company wants to ensure that wireless guest networks cannot reach corporate internal resources. Which architectural control achieves this most effectively?
Select an answer to reveal the explanation.
Short Explanation
You want real network isolation, so put the guest SSID on its own VLAN that only routes to the internet and blocks internal RFC 1918 subnets at the firewall. That keeps guests off corporate resources no matter what credentials they use.
Full Explanation
The correct control is to isolate the guest SSID on a separate VLAN routed only to the internet, with firewall rules blocking access to all internal RFC 1918 subnets. This provides network-level isolation regardless of what credentials a guest uses. A strong WPA3 passphrase on the guest SSID is wrong because it prevents unauthorized wireless access but does not restrict what an authorized guest can reach on the internal network. Enabling client isolation on the guest SSID is wrong because it only prevents guest-to-guest communication, not guest-to-corporate access. Deploying a captive portal on the guest network requiring email registration is wrong because it is an access control measure for the guest network itself, not a control preventing access to internal resources.