Which of the following statements are correct about firewall security zones?

Security zones are used to classify interfaces by trust level and simplify policy control. Traffic control decisions are usually applied between zones (interzone), and many firewall products (including Huawei) treat intrazone traffic differently from interzone traffic. Typically, communications between hosts within the same zone are not the primary target of security policy control, and mutual access within a zone does not have to be explicitly permitted by security policies in the same way as traffic between different zones. Therefore, statement A is correct in the context of zone-based policy control.

Firewall policies are created with a source zone and destination zone (and other match conditions), and they can be written to allow traffic in a specific direction (for example, Trust → Untrust) while denying the reverse direction (Untrust → Trust). That makes statement B correct: policies can be directional.

Statement C is incorrect because Huawei firewalls also include a default Local zone in addition to Trust, Untrust, and DMZ. Statement D is incorrect because an interface (or sub-interface) is assigned to one security zone; assigning the same interface to multiple zones would break the trust-boundary model and policy evaluation.