A company runs a public-facing web server that customers access from the internet. The security team wants to allow this inbound public access while ensuring that if the web server is compromised, an attacker cannot directly reach the internal corporate network where sensitive databases and employee workstations reside. Which network design best meets this goal?