What is a DMZ (demilitarized zone) in network architecture, and which device type enforces the security boundary between the DMZ, the internet, and the internal network?

• A.A DMZ is an isolated network segment between two firewall interfaces that hosts internet-facing services (web, email, DNS); a firewall with at least three interfaces enforces rules: internet traffic can reach DMZ hosts, but DMZ hosts cannot initiate connections to the internal LAN
• B.A DMZ is an older term for a load balancer cluster positioned in front of web servers, which still spreads inbound sessions across a farm of identical nodes and keeps a health probe running against each of them so a failed member is pulled out of rotation quickly by the controller
• C.A DMZ is enforced by a Layer 2 switch using VLANs without routing; no firewall is needed between segments, given that Layer 3 switches cannot route between VLANs without an external router on a stick. A firewall in routed mode is invisible to traceroute because it forwards at Layer 2
• D.A DMZ is a VLAN dedicated to guest Wi-Fi users; its boundary is enforced by the wireless controller, and SFP transceivers convert optical signals to Wi-Fi for last-meter delivery. A proxy ARP router answers ARP requests only for hosts inside the same broadcast domain as the requester