During initial provisioning of a new ward's access switches, the network team wants administrative access to each switch to be isolated from the clinical and guest data traffic those switches carry. What design choice accomplishes this?

A dedicated management VLAN separates the traffic used to administer switches — SSH, SNMP, syslog, and similar — from the VLANs carrying regular clinical or guest data, which limits which devices and users can even attempt to reach the switch's management plane and reduces the attack surface. Using the guest VLAN for management is a serious anti-pattern precisely because guest devices are the least trusted population on the network; putting administrative access reachable from that VLAN invites exactly the kind of exposure a segmented design is meant to prevent. Sharing the clinical VLAN for management traffic mixes administrative access with a broadcast domain full of clinical workstations and possibly biomedical devices, meaning a compromised clinical endpoint would sit on the same segment as the switch's own management interface. Disabling VLANs altogether removes the fundamental tool used to segment traffic in the first place, collapsing every distinction between guest, clinical, biomedical, and management traffic into one flat, insecure broadcast domain — the opposite of the stated goal. Caveat: a management VLAN should also be paired with access control restricting which source addresses may reach it, since VLAN separation alone is not equivalent to a firewall policy. Operational check: confirm from a test device on the clinical or guest VLAN that the switch's management interface is not reachable, while confirming it is reachable from the intended management subnet.