An administrator needs three distinct security zones in a company's network. Which of the following is the administrator MOST likely to implement?

Host-based firewalls protect individual endpoints rather than creating network-wide security zones, so they cannot segment traffic between different parts of the infrastructure.

A Layer 3 firewall operates at the network layer and uses multiple interfaces or subinterfaces to define separate security zones such as a DMZ, internal LAN, and untrusted external network. It enforces access control policies between zones through stateful packet inspection and ACLs applied per interface, making it purpose-built for multi-zone network segmentation. This architecture directly satisfies the requirement for three distinct security zones with controlled traffic flow between them.

A web application firewall inspects HTTP/HTTPS application-layer traffic to protect web applications and does not provide the network-level zone segmentation needed for distinct security zones.

A circuit-level gateway operates at the session layer to monitor TCP handshakes but is not designed to segment a network into multiple distinct security zones with separate inter-zone policies.