A guest network must not reach internal payroll servers. What control directly enforces this boundary?

1. Routing firewall or ACL policy between segments
2. A different guest SSID name alone
3. A longer guest DHCP lease
4. Disabling client-side browser bookmarks