Your company will migrate several servers to Azure. Compliance requires that the server named FinServer be placed on a separate network segment. Which Azure solution should you recommend?

The correct answer is a virtual network for FinServer and another virtual network for all other servers. Virtual networks (VNets) in Azure provide network isolation, allowing you to segment your network traffic and define separate network spaces. This directly addresses the compliance requirement to place FinServer on a separate network segment. Resource groups are logical containers for Azure resources and do not provide network isolation, so separating servers into different resource groups wouldn't meet the requirement. A VPN is used for secure connections over public networks, not for internal network segmentation within Azure. A virtual network gateway is used to connect VNets or to connect to on-premises networks, not for creating separate network segments for individual servers. Resource locks prevent accidental deletion or modification but don't provide network segmentation.