An administrator has recently moved all VoIP to a CaaS offering. In order to ensure that VoIP traffic remains separate from the rest of the data traffic, which of the following MUST be done?

Tagging VoIP frames with a dedicated VLAN ID isolates voice traffic into its own Layer 2 broadcast domain, preventing it from competing directly with data traffic on the same segment. This separation is a prerequisite for applying targeted QoS policies, reducing jitter and packet loss, and meeting the real-time performance requirements of VoIP regardless of which cloud provider hosts the CaaS platform.

Creating a new subnet by the CSP provides Layer 3 routing separation but does not enforce Layer 2 traffic isolation; without VLAN tagging, voice and data frames still intermingle on the same physical or virtual switch segment.

A private VPN encrypts traffic in transit between endpoints but does not segregate VoIP from data traffic on the local network where both originate, leaving them on the same logical segment.

QoS policies prioritize VoIP packets for lower latency and higher bandwidth but do not create a separate logical network; both traffic types continue to share the same broadcast domain.