A hospital wants patient and visitor devices on the guest WLAN kept completely separate at the network layer from the WLAN used by clinical staff laptops, even though both networks are broadcast from the very same access points. What WLAN configuration choice enforces this separation?
Select an answer to reveal the explanation.
Short Explanation
Two networks can share the same radios and still never mix, as long as they're pointed at different destinations underneath. Giving each SSID its own VLAN is what actually keeps guest and staff traffic apart, no matter how close together their signals sit in the air.
Full Explanation
Assigning separate client VLANs to the guest and staff WLAN profiles is what actually creates Layer 2 separation between the two populations, even when both SSIDs are broadcast from the same physical APs — the VLAN tag, not the airtime, is what keeps their traffic from mixing on the wired side. A longer or more obscure SSID name is purely cosmetic and provides no technical separation whatsoever; a guessable versus unguessable name has nothing to do with where traffic is forwarded. Restricting the guest WLAN's broadcast schedule controls when the network is available, not which traffic domain it lands in when it is available — it solves an availability question, not a segmentation one. Splitting the two WLANs across different radio bands (say, guest on 2.4GHz and staff on 5GHz) is also not real segmentation, since a client roaming or a misconfigured dual-band setup could still put a device on either band without changing which VLAN it lands on afterward — band and VLAN are independent settings. A caveat: VLAN separation alone doesn't guarantee isolation between clients on the same VLAN; if true guest-to-guest isolation is also required, that's a further, separate setting. Operational check: confirm via DHCP leases that a device on the guest SSID receives an address from the guest subnet, never the clinical staff subnet.