Which of the following network architecture concepts is used to securely isolate at the boundary between networks?

VLANs logically segment traffic within an internal network but are not specifically designed to enforce security isolation at the boundary between trusted and untrusted networks.

Subnetting divides an IP address space into smaller logical networks for management and routing purposes, not specifically for security boundary isolation.

A DMZ (demilitarized zone) creates an intermediate network segment separated from both the public internet and the internal network by firewalls. Services accessible from the outside (e.g., web servers) are placed in the DMZ so that a compromise does not grant direct access to the internal network, providing security isolation at network boundaries.

NAT translates private IP addresses to public ones, which provides some obscurity, but it is not a network isolation mechanism designed to enforce security boundaries.