A network administrator needs to allocate a new network for the R&D group. The network must not be accessible from the Internet regardless of the network firewall or other external…

Configuring the OS default TTL to 1 is an easily bypassed host-level setting and does not provide robust network-wide isolation regardless of misconfigurations.

Using NAT on the R&D network facilitates Internet access by translating private IP addresses to public ones, which is the opposite of the requirement.

Implementing a router ACL is a configuration that could be misconfigured or bypassed if traffic routes around that specific router, failing the requirement of protection regardless of misconfigurations.

Protected ports (also known as private VLAN edge ports) on a switch prevent direct communication between individual ports within the same switch, forcing all traffic from these ports to a designated uplink (promiscuous) port. By dedicating this promiscuous port to a router or firewall that is explicitly configured without any path to the Internet, this mechanism ensures that devices in the R&D network cannot establish external connections, providing a robust Layer 2 isolation that is resilient to higher-layer routing or firewall misconfigurations.