A network security architect is tasked with redesigning the enterprise network to reduce the attack surface. Which approach directly reduces the number of exploitable network paths an attacker can take?

B is correct because segmentation combined with ACLs limits the permissible traffic paths between zones, forcing attackers to traverse controlled checkpoints rather than move freely. A is wrong because bandwidth is a performance concern with no direct security benefit. C is wrong because a SIEM improves detection but does not reduce network attack surface. D is wrong because VPN protects remote access but does nothing to prevent lateral movement on the already-flat internal network.