312-39V2: Certified SOC Analyst v2

The SOC team must improve the security of an organization's network infrastructure. The organization's public-facing web servers, which process customer transactions, must be separated from the internal private network that contains sensitive employee data and proprietary systems. The objective is to create a buffer zone that reduces internal-system exposure if the web servers are compromised in a cyberattack, such as a DDoS or SQL injection attempt. As a SOC analyst, which network architecture component would you recommend to establish this isolated region?