Which of the following is a physical or logical subnetwork that contains and exposes external services of an organization to a larger network, usually the Internet?

NAT (Network Address Translation) translates private IP addresses to public ones but does not create a separate subnetwork zone for hosting external services.

A firewall is a security device that filters traffic between network zones but is not itself the subnetwork that hosts external services.

A DMZ is a perimeter network architecture that exposes an organization's external-facing services such as web servers, mail servers, and DNS to the Internet while keeping the internal network protected. Traffic from the Internet can reach DMZ hosts but is blocked from traversing directly into the internal LAN, typically enforced by two firewalls or a dual-homed firewall. This isolation limits the blast radius if a DMZ host is compromised.

A VLAN segments a network at Layer 2 for traffic isolation and management but is not specifically designed to expose external organizational services to the Internet.