Architects are redesigning how the city's public website reaches the Internet so a compromise of that host cannot freely traverse into internal finance systems. Which network pattern best supports that goal?

A screened subnet (DMZ) isolates Internet-facing systems such as municipal websites behind layered firewalls or filtering, with tightly controlled paths into internal networks. That architecture limits lateral movement if the public host is compromised. Co-locating public servers with sensitive internal systems or removing segmentation increases blast radius.