A security administrator is segregating all web-facing server traffic from the internal network and restricting it to a single interface on a firewall. Which of the following BEST describes this new n

A VLAN is a logical segmentation of a switched network at Layer 2 but does not inherently describe the architecture of isolating public-facing servers from an internal network via a firewall.

A subnet is an IP address range division and does not by itself imply the security segregation or firewall-controlled isolation described.

A VPN creates an encrypted tunnel for secure remote access or site-to-site connectivity and is unrelated to segregating web-facing servers.

A DMZ is specifically designed to place internet-facing servers on a separate, isolated network segment controlled by a dedicated firewall interface. This architecture restricts direct access between external traffic and the internal network, which exactly matches the described scenario of segregating web-facing traffic to a single firewall interface.