A hospital must protect traffic between its server VLANs, which are routed by the existing router through a Layer 2 switch. The network team requires every server IP address and default gateway to stay exactly as they are, and the existing router configuration is frozen. The FTD has been placed physically between the switch and that router, so all inter-VLAN traffic traverses it, and it must actively block traffic by policy. Which deployment mode meets these insertion requirements?

Transparent mode makes the FTD a layer 2 bridge: frames enter one interface and leave the other with their original addressing intact, so no server IP address and no default gateway has to change and the frozen router is never edited. Because the appliance still sits inline in the path, the access control policy can inspect and drop traffic, which satisfies the enforcement requirement. Routed mode with a transit subnet fails the addressing requirement, since it introduces new interface subnets and moves the servers' default gateway onto the appliance. Passive monitoring mode fails the enforcement requirement, because a sensor watching the segment can report what it sees but cannot drop a session. Routed mode with a one-arm interface and policy routing fails the router requirement, because steering traffic to the appliance means editing the very configuration the customer has frozen, and it also makes the FTD a layer 3 hop. Exam caveat: transparent mode does not offer every routed feature, and capabilities such as dynamic routing do not apply to a layer 2 bridge, so confirm the deployment needs first. Practical check: after insertion, ping the gateway from a server using its original address and then verify that a blocked flow is actually dropped by the policy.