A company is separating its accounting department’s network from its customer service department’s network.

A VLAN (Virtual Local Area Network) is the correct solution because it logically separates devices into different broadcast domains on the same physical switching infrastructure. In CompTIA A+ Core 1 (220-1201), VLANs are described as a way to segment a network for security, performance, and management—for example, isolating departments like Accounting and Customer Service so their traffic is separated. Devices assigned to different VLANs cannot communicate directly at Layer 2; communication between VLANs requires a Layer 3 device (such as a router or a Layer 3 switch) using inter-VLAN routing and appropriate access control. This effectively prevents unnecessary broadcast traffic from crossing department boundaries and helps enforce separation policies.

A VPN is used to create an encrypted tunnel over an untrusted network (commonly for remote access or site-to-site connectivity), not for internal departmental segmentation. DNS resolves hostnames to IP addresses and does not isolate networks. DHCP automatically assigns IP configuration (IP address, gateway, DNS servers), but it does not provide segmentation by itself. Therefore, implementing VLANs is the best way to separate the two departments’ networks.