VLAN
Virtual LAN. A broadcast domain with a tag. Segmentation only if the rest of the design agrees.
A VLAN splits a switch fabric into separate layer-2 networks, usually with an 802.1Q tag. Hosts in one VLAN do not see broadcasts from another unless a router, or a misconfigured trunk, joins them.
A VLAN is not a security zone until you filter at the layer-3 boundary and keep trunks honest. Management sitting on the same box as guests is a habit you can stop. Pair with real network segmentation, not just pretty colours in the switch UI.
See also: Network segmentation, Firewall, Network address translation.