A regional hospital must place an FTD in front of a new server farm. The user VLANs and the server subnet are different networks, so the firewall has to route between them; threats must be actively blocked rather than just logged; and every existing host IP address must stay unchanged. Which deployment mode satisfies these insertion requirements?

Routed mode is the fit because the FTD can act as a Layer 3 hop between the distinct user and server networks, while an intrusion policy configured to drop matching threats provides active prevention. Its interfaces can be assigned addresses on the existing subnets, so host IP addresses need not be renumbered; routing and default-gateway settings may still need to direct traffic through the FTD. A transparent deployment is a valid inline choice when preserving addressing and blocking threats are priorities, but it bridges at Layer 2 rather than routing between the two networks; having an adjacent router do that routing does not meet the requirement that the firewall route between them. Renumbering a subnet can be a workable part of some routed-firewall insertions, but it violates the explicit requirement to keep every existing host address unchanged. Detection-only intrusion policies are useful for observation and tuning, yet they alert on matching threats instead of dropping them, so they do not provide the required active blocking. Exam caveat: distinguish the FTD’s deployment mode from its intrusion policy action—routed mode alone does not guarantee that threats are blocked. Practical check: verify the interface subnet assignments and traffic path, confirm hosts retain their IPs, and test that a matching intrusion event is dropped rather than merely logged.