A computer is put into a restricted VLAN until the computer's virus definitions are up-to-date. Which of the following BEST describes this system type?

NAT (Network Address Translation) translates private IP addresses to public ones for routing purposes and has no role in endpoint health assessment or VLAN assignment.

NIPS (Network Intrusion Prevention System) monitors and blocks malicious network traffic in real time but does not assess endpoint compliance or manage VLAN placement.

NAC evaluates endpoint compliance - including patch level, antivirus signature currency, and firewall status - before granting full network access. Non-compliant devices are automatically assigned to a restricted VLAN where they can only reach remediation resources until they meet policy requirements, which exactly describes the scenario.

A DMZ is a network segment that separates public-facing servers from the internal network and is not a dynamic compliance enforcement mechanism.