Out of all answers provided, 'A' is the 'most correct one'. ...But I would recommend to read the article within the link below as it explains the need for defence in depth approach from the firewall perspective (i.e. utilising firewall protection from only one layer of the OSI stack is not deemed best practice for obvious reasons). In a nutshell, if the organisation mentioned in the question has no layer 3 firewall between the trusted, DMZ and untrusted zones then placing a layer 7 firewall only partially solves the mission of intent (that of mitigating in the most effective and efficiently (within the allocated budget) way possible any potential threats). Know Your Firewall: Layer 3 vs. Layer 7 https://www.twistlock.com/2018/10/23/know-firewall-layer-3-vs-layer-7/