A guest wireless client should access the internet but never internal file servers. What is the best network control?

1. A longer DHCP lease time
2. The same production VLAN with a different SSID name
3. A guest segment with rules blocking internal destinations
4. A hidden guest SSID with unrestricted routing