A company is developing a new secure technology and requires computers being used for development to be isolated. Which of the following should be implemented to provide the MOST secure environment?

A perimeter firewall and IDS still maintain a network connection to external systems, leaving the environment vulnerable to sophisticated attacks that bypass or exploit firewall rules and IDS signatures.

An air gapped network is completely physically disconnected from external networks, meaning there is no possible electronic pathway for remote attackers to access the systems. This physical isolation eliminates network-based attack vectors entirely, making it the most secure option for protecting sensitive or classified technology development where even a compromised perimeter device could not expose the systems.

A honeypot in a DMZ is a deception tool designed to attract attackers and study their behavior, not to isolate and protect legitimate development systems.

An ad hoc network with NAT still allows outbound internet connectivity and lateral communication between devices, which does not provide true isolation from external threats.

A bastion host is a hardened gateway that controls access into a network, but it still maintains network connectivity and does not physically isolate the development environment from external networks.