An administrator must increase the security posture of an organization.

A screened subnet, also commonly called a DMZ, is the best and most cost-effective deployment for isolating an external-facing web server from the internal organization. A screened subnet places publicly accessible systems in a separate network segment between the internet and the trusted internal network. Firewall rules can then strictly control what traffic is allowed between the internet, the screened subnet, and the internal network. This reduces the risk that a compromised public web server can directly communicate with or attack internal systems.

The CompTIA Network+ N10-009 objectives include network segmentation, security zones, screened subnets, firewalls, and access control. A screened subnet is a standard design for services that must be reachable from untrusted networks while protecting internal resources.

An IPS can detect or block malicious traffic, but it does not provide the same segmentation design by itself. A WAF protects web applications from application-layer attacks, but it does not necessarily prevent the web server from communicating with internal systems. An ACL may help, but a screened subnet provides the better architectural control. Therefore, the correct answer is a screened subnet for the web server.