Which of the following is the appropriate network structure used to protect servers and services that must be provided to external clients without completely eliminating access for internal users?

NAC (Network Access Control) is an access policy enforcement mechanism that controls which devices can connect to a network based on compliance or identity, not a network structure designed to segment public-facing servers from internal resources.

VLANs are a Layer 2 segmentation technology used to logically separate network traffic, but they are not specifically designed as a security architecture to isolate publicly accessible servers from both external and internal threats in the way a DMZ is.

A DMZ is a perimeter network segment placed between an untrusted external network (internet) and a trusted internal network, typically enforced by two firewalls or a dual-homed firewall. Servers requiring public access (web, email, DNS) are placed in the DMZ so that if they are compromised, attackers cannot directly reach the internal network. Internal users can still access these services, but the DMZ architecture enforces strict traffic controls in both directions.

A subnet is a logical IP addressing division of a network used for routing and organization purposes, and while subnets can be part of a DMZ implementation, a subnet alone does not provide the firewall-enforced security boundary that defines a DMZ.