Which statement about IOS zone-based firewalls is true?

An unassigned interface is implicitly considered to be in a 'null' zone and cannot communicate with an assigned interface unless explicitly configured to do so via zone-to-zone policies, which is not the default behavior.

Multiple interfaces can be assigned to the same zone, for instance, all interfaces connected to an internal LAN segment can be grouped into an 'inside' zone.

Assigning an interface to multiple zones would create ambiguous policy enforcement and is explicitly prevented by the design of IOS Zone-Based Firewalls.

In Cisco IOS Zone-Based Firewalls, a fundamental rule is that an interface can be assigned to only one zone at a time, which ensures clear segregation of network segments and consistent application of security policies for traffic flowing between zones.