An enterprise deploys a kiosk network where 30 public-facing kiosks share a single Wi-Fi SSID. Which AP/VLAN feature ensures that a compromised kiosk cannot scan or attack other kiosks on the same SSID?

• A.Band steering - moving kiosks to the 5 GHz band ensures their traffic does not overlap with 2.4 GHz devices
• B.SSID hiding - by hiding the SSID, kiosks cannot discover each other through active probing
• C.WPA2-Enterprise with 802.1X - each kiosk authenticates with a unique certificate, preventing lateral movement
• D.Client isolation (AP isolation) - when enabled, the AP blocks direct Layer 2 communication between wireless clients on the same SSID, so kiosk A cannot send frames to kiosk B even though they share the same AP and SSID