A security administrator is creating a subnet on one of the corporate firewall interfaces to use as a DMZ which is expected to accommodate at most 14 physical hosts. Which of the following subnets…

The subnet mask 255.25.255.248 is invalid - the second octet '25' is not a valid subnet mask value; valid octets in a subnet mask must follow a contiguous bit pattern (e.g., 255.255.255.248).

A /28 prefix length corresponds to a subnet mask of 255.255.255.240, which provides 16 total addresses - 14 usable host addresses after subtracting the network and broadcast addresses. This exactly meets the requirement of 14 physical hosts without unnecessary waste, and the IP address 192.168.0.16 is a valid network address for a /28 block.

The subnet mask 255.255.25.240 is also invalid because '25' in the third octet is not a legal subnet mask value, making this an unusable and incorrect subnet definition.

A /27 prefix provides 32 total addresses with 30 usable hosts, which accommodates the 14-host requirement but wastes significantly more address space than a /28, making it a suboptimal choice when the question asks for the BEST fit.