While standing up a proof-of-concept solution with a vendor, the following direction was given for connections to the different environments: Which of the following is being used to secure the three…

A separation of environments policy is an administrative governance control that defines rules and procedures for keeping environments isolated but does not technically enforce network-level separation between servers sharing the same DMZ.

Logical access controls restrict which users or systems are authorized to access specific resources but operate at the authentication and authorization layer, not at the network layer, so they do not prevent direct network-level communication between servers in the same DMZ.

VLANs create isolated Layer 2 broadcast domains on shared physical switch infrastructure, meaning servers assigned to different VLANs cannot communicate directly even when connected to the same physical switches in the DMZ. Traffic between environments must traverse a Layer 3 device enforcing access control policies, providing a technical enforcement boundary that prevents overlap and unauthorized cross-environment access.

Subnetting divides IP address space and can influence routing boundaries, but the question specifies on-premises servers in a DMZ rather than cloud environments, and subnetting alone without enforced routing and access control policies does not provide the Layer 2 isolation that VLANs deliver within a shared physical infrastructure.