The "NSA Methodology for Adversary Obstruction" outlines steps to segregate networks and functions. One of these methods is DMZ isolation. By ensuring that the DMZ is properly segregated both through physical and network architecture and admin/user accounts, a network owner can greatly decrease the external attack surface.

The correct word for the blank space is: logical.

Explanation:

A logical network is one that could be either physical or part of a larger network but is portrayed to end-users virtually. Logical networks can also be a group of networks that are compressed to make them work as a single unit. The last method is generally used more often when there is a merely physical network that should work with a virtual network.