A clinic must keep life-support equipment separate from guest Wi-Fi while allowing narrowly defined management traffic. Which design is most appropriate?

1. Separate network segments with explicit inter-segment controls
2. Use one shared subnet with different device names
3. Disable encryption to simplify troubleshooting
4. Publish management interfaces through the guest portal