Which device separates networks by security domains?

An intrusion protection system (IPS) primarily monitors for and blocks malicious activity within a network, rather than segmenting networks by security domains.

A firewall operates by inspecting network traffic and enforcing defined security policies to permit or deny traffic between different network segments or security zones, thereby separating networks into distinct security domains.

A wireless controller centrally manages and provisions multiple access points but does not primarily separate networks into security domains.

An access point provides wireless connectivity to devices and bridges wireless clients to a wired network but does not inherently separate networks by security domains.