The city puts VDI desktop VMs on a new VLAN so they are not on the same Layer 2 domain as physical printers in the basement. Which basic networking idea is that?

Placing VDI desktop VMs on a new VLAN so they are not on the same L2 domain as basement printers is switch/VLAN segmentation of the desktop guest network. In municipal EUC terms, treat the endpoint as a window into city systems when the architecture says so, not as the system of record for the files or apps in the stem. Distractor concept: UAG in the DMZ does not create the desktop VLAN on ESXi. Distractor concept: UEM compliance does not assign VLANs to instant-clone virtual disks. Distractor concept: DEM printer mapping does not move the VM onto a new overlay as the segmentation mechanism. Exam caveat: L2 separation of desktop guests = VLANs/switching basics. Operational check: Confirm desktop port groups use the dedicated VLAN and are not bridged to the printer VLAN. Record the chosen control and the rejected failure modes in the civic change ticket or runbook so on-call staff and auditors share the same rationale after the next maintenance window. Re-validate after personnel or image changes that the same control still meets the city's continuity, security, and support expectations for this service. Helpdesk coaching tip aligned to the conversational brief: A VLAN is a separate hallway in the same building so clerk desktops are not shouting on the printer LAN. Switching segments that Layer 2 domain. UEM compliance and DEM printer maps do not carve the VLAN.