Company XYZ is revisiting the security design for their data center because they now have a requirement to control traffic within a subnet and implement deep packet inspection. Which technology…

A zone-based firewall on a Layer 3 device enforces policy between routed interfaces and zones, so it cannot inspect or control traffic that remains within a single subnet because that traffic never crosses a Layer 3 boundary.

A routed firewall also operates at Layer 3 and sits between subnets as a default gateway; it cannot intercept intra-subnet traffic because such traffic is switched at Layer 2 and never routed through the firewall.

A transparent firewall functions as a Layer 2 'bump in the wire,' meaning it can be inserted anywhere in the network - including within an existing subnet - without altering IP addressing or routing topology. Because all frames pass through it, it can perform stateful deep packet inspection on intra-subnet traffic between hosts, directly satisfying both requirements stated in the scenario.

VLAN ACLs on a switch can filter traffic within a VLAN using header-based permit/deny rules, but they do not support stateful deep packet inspection of application-layer content.