A bank is placing a Threat Defense appliance between the core switch and the ISP link in routed mode, with private subnets inside and public addresses outside. Engineers must settle addressing, NAT and routing before go-live. Which statement describes how routed mode forwards traffic between its interfaces?

In routed mode, the appliance has Layer 3 addresses on its interfaces and consults its routing table to choose a next hop for each packet. NAT may translate private source addresses to public addresses, but it does not replace the routing decision. The statement about bridging interfaces at Layer 2 describes transparent mode, which preserves the addressing on the respective sides; it does not describe the stated routed mode. A default route toward the ISP is a common outbound configuration, but it does not make specific internal routes unnecessary. Traffic destined for internal networks, including return traffic, may require routes to those networks; a default route sends unmatched destinations toward the ISP. Policy-based routing can steer selected traffic, but it does not replace the routing table as the basis for routed-mode forwarding. Exam caveat: NAT, routing, and security policy are distinct functions, and processing order or configuration requirements can vary by platform; NAT is not inherently required on every interface for forwarding. Practical check: before go-live, inspect interface addressing, the routing table—including internal routes and the ISP default route—and NAT rules, then use a packet-tracer or equivalent test for outbound and return traffic.