A regional insurer must inspect traffic flowing from a core switch into a server farm using one existing Secure Firewall Threat Defense appliance, and the change ticket forbids re-addressing hosts, altering the servers' default gateway, or changing the subnet layout. Which deployment mode best satisfies the ticket's insertion constraints?
Select an answer to reveal the explanation.
Short Explanation
Right, you matched the mode to the constraint. Transparent mode works as a Layer 2 bridge, so hosts' addresses and gateways stay untouched. Routed mode requires Layer 3 changes that the ticket rules out.
Full Explanation
Transparent mode makes the appliance a Layer 2 bridge in the path, so the hosts' IP addresses, subnet layout, and default gateway can remain unchanged while the access control policy inspects traffic. In a routed insertion, the appliance uses Layer 3 interfaces, which requires routing changes; NAT exemption only adjusts address translation and does not remove that requirement. Advertising the farm with OSPF adds a dynamic route but does not eliminate the need for appropriate Layer 3 addressing and routing. A hardware bypass module can provide fail-open behavior on supported appliances, but it does not make a routed insertion satisfy the ticket's constraints. Transparent mode has feature and design limitations, so it suits a Layer 2 insertion rather than a design where the firewall must act as the gateway. Confirm that the servers retain their original gateway and can still reach their database after the policy is deployed.