The correct option is VLAN.

A VLAN creates logical segments on a switched network so each segment operates as its own broadcast domain. By assigning switch ports or devices to different VLANs the switch confines broadcast traffic to only the devices in the same VLAN, and traffic between VLANs requires routing or a layer 3 device so you can enforce inter-team policies.

Virtual Private Network provides encrypted tunnels for secure communication over untrusted networks and it does not create separate layer 2 broadcast domains on a local switch. It can isolate remote user traffic but it is not the mechanism used to keep two local teams in separate broadcast domains.

IP subnetting divides an IP address space into smaller networks which define layer 3 boundaries and can correspond to separate broadcast domains when routed. Subnetting alone does not change how a switch forwards layer 2 broadcasts on the same physical LAN unless you also implement switch level segmentation with technologies such as VLANs.

Demilitarized zone is a security zone used to expose or isolate public facing services from internal networks and it is not a switch feature for separating internal teams into independent broadcast domains.

Full AWS Practitioner Certification Question