An administrator is building a web server to host an online banking application. The server should not have access to the internal network, and only ports that are used by the application should be…

Placing the server on the internal network directly contradicts the requirement that it must not have access to the internal network, and IPSec encryption does not substitute for network segmentation.

An ISA (Internet Security and Acceleration) server is a legacy Microsoft proxy and caching product, not the standard or appropriate solution for network-level isolation and port filtering of a web application server.

VPN creates encrypted tunnels for secure remote access between endpoints and does not function as a port-blocking or network isolation mechanism for a hosted server.

A company firewall enforces network segmentation by placing the web server in a DMZ, which architecturally prevents it from directly reaching the internal network. It also applies port-based access control rules to permit only the specific ports the banking application uses, satisfying both isolation and port restriction requirements simultaneously.