A security administrator is segregating all web-facing server traffic from the internal network and restricting it to a single interface on a firewall. Which of the following BEST describes this new…

A VLAN logically segments a network at Layer 2 but does not inherently provide the security isolation architecture described for separating web-facing servers from the internal network via a firewall interface.

A subnet is a Layer 3 network division used for IP address management and routing, not a security architecture pattern for isolating public-facing servers from internal traffic.

A VPN creates an encrypted tunnel for secure remote access or site-to-site connectivity, which is unrelated to segregating web-facing server traffic from an internal network.

A DMZ is specifically designed to host web-facing servers in an isolated network zone between the public internet and the internal network, with a firewall controlling traffic on a dedicated interface - exactly matching the described scenario of segregating web-facing traffic to a single firewall interface.