A university is inserting an FTD appliance between its campus core switch and a new research VLAN of 300 hosts. The hosts must keep their existing IP addresses, the appliance must be the segment's default gateway, and the appliance must translate outbound traffic so it leaves through one public address. Which operating mode meets all three requirements for the research VLAN?
Select an answer to reveal the explanation.
Short Explanation
Routed mode makes the appliance a Layer 3 hop, so you point the hosts at it as their gateway while dynamic PAT translates the whole segment to one public address. Transparent mode bridges frames instead of routing them, so it cannot be the research VLAN's default gateway. It's like a turnstile: you step through the box first, and only then does your ticket get stamped.
Full Explanation
Routed mode makes the appliance a Layer 3 hop, which lets it hold the address the research hosts use as their default gateway, inspect every packet as it forwards, and apply dynamic PAT so the segment shares a single public address on the way out. Hosts keep their existing addresses because only the next hop changes, so all three requirements land on the same design. Transparent mode in a bridge group is the classic no-readdressing insertion, and a NAT policy can be defined there too, but the appliance is not a routed hop, so nothing in the segment can point at it as a gateway. Routed mode with translation switched off still terminates the segment and preserves host addressing, but the appliance does not translate the hosts' outbound traffic to the required shared public address. Readdressing the research subnet with NAT satisfies routing and translation but changes the addresses that must stay put. Exam caveat: many-to-one PAT and one-to-one NAT are both translation, so read carefully whether the question specifies one shared address. Practical check: after cutover, confirm the default gateway on a couple of hosts, then watch the NAT table while they browse.