The main idea here is that a firewall sits at the edge of a network and acts as a gatekeeper, applying security rules to allow or block traffic between networks. Its primary purpose is to enforce security policies by controlling what traffic is permitted to pass from one network to another, helping to prevent unauthorized access and protect sensitive systems. This is why firewalls are central to network security: they enforce policy-based access, monitor traffic, and can block or alert on suspicious activity. Other options describe different network tasks: improving routing efficiency is the job of routers and routing protocols, not firewalls; encryption at rest relates to protecting data stored on devices, not filtering traffic; managing IP address allocation is handled by DHCP or IP address management tools.

The design number is used to signal substantial redesigns within the same mission family. It identifies major changes to the aircraft’s airframe, systems, or performance that affect how it operates, while still serving the same basic role. This helps maintain clear maintenance, training, and logistics footing since a new design number means the aircraft requires updated documentation and procedures for the new configuration. So the best choice is that the design number identifies major changes within the same basic mission. Minor updates or production year alone wouldn’t justify a new design number, and changes in manufacturer aren’t implied by the design number either. If the aircraft only receives small upgrades or field fixes, these wouldn’t trigger a new design number.

In IPv6, addresses are organized into unicast, multicast, and anycast types. Among the options, the one that fits as a main IPv6 address type is Global Unicast. Global Unicast addresses are the globally routable addresses on the Internet, similar in purpose to public IPv4 addresses, with prefixes like 2000::/3. This makes them the primary category for addresses that can be reached from anywhere on the Internet. The other options don’t fit as a main IPv6 address type: IPv4 Private Address is an IPv4 concept, not IPv6; Loopback Address (::1) is a special single-host unicast address used for testing that isn’t a broad category of address; and Broadcast Address doesn’t exist in IPv6 (IPv6 uses multicast to handle group communications instead of broadcast).

You enforce the boundary between trusted and untrusted networks by placing a firewall at the network perimeter, between the internal LAN and the Internet or DMZ. This position creates a single choke point where traffic can be inspected and filtered according to security rules before it crosses into or out of the trusted network. It lets you control what enters from untrusted networks and what leaves the internal network, helps protect internal hosts, and supports exposing only necessary services through a DMZ. Choosing a host-based firewall on individual machines only protects each device, not the whole network boundary. Putting a firewall on the internal switch wouldn’t create a boundary to enforce policy between trusted and untrusted sites. Adding firewalls between every pair of servers is unnecessary and impractical. The perimeter placement provides a scalable, centralized means to enforce access control at the critical boundary.