Implementing Virtual LANs (VLANs) is the most appropriate method. VLANs logically segment a single physical network into multiple, isolated broadcast domains at Layer 2. A dedicated "guest" VLAN can be created to isolate guest devices. To provide controlled internet access while preventing access to internal systems, Access Control Lists (ACLs) are applied at Layer 3 (on a router or multilayer switch). This configuration allows traffic from the guest VLAN to be routed only to the internet gateway, while explicitly denying any traffic destined for internal corporate network subnets. This approach is highly scalable, uses existing network hardware, and is a standard, efficient practice for this scenario, thus minimizing configuration effort.

A. Creating air-gapped networks for guest devices.

An air-gapped network is physically isolated and cannot connect to the internet, which violates a core requirement of the scenario.

C. Using firewall-based segmentation for all traffic.

While a valid segmentation method, it can be more complex and costly than VLANs/ACLs for this specific use case and may introduce a central performance bottleneck.

D. Configuring port mirroring on guest access ports.

Port mirroring (SPAN) is a passive traffic monitoring technique for network analysis; it does not provide any traffic isolation or segmentation.

1. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Section 6.4.4, "Virtual Local Area Networks (VLANs)," the text explains that VLANs allow a single physical LAN infrastructure to be partitioned into multiple virtual LANs, with traffic isolation between them. It states, "VLANs can be used to restrict the set of users who can access a network server... a major use of VLANs is to isolate traffic."

2. Cisco. (2002). Internetworking Technology Handbook: Virtual LANs (VLANs). Cisco Press. Chapter 51 explains, "VLANs are used to segment a LAN into multiple broadcast domains... Traffic between VLANs must be routed." This establishes the foundation for using a router or Layer 3 switch with ACLs to control inter-VLAN communication, which is the standard method for isolating a guest network.

3. Olifer, N., & Olifer, V. (2006). Computer Networks: Principles, Technologies and Protocols for Network Design. John Wiley & Sons. Chapter 17, "Virtual Networking," Section 17.1.3, "VLAN Security," discusses how VLANs provide isolation and how inter-VLAN traffic must pass through a router, which "can apply filtering rules to this traffic," directly referencing the use of ACLs for security between segments.