Which of the following statements is correct about characteristics of a firewall?

A firewall is primarily a boundary security device used to control traffic between networks of different trust levels, such as an intranet and an extranet or the Internet. Its key capability is enforcing access control based on security policies, which helps prevent unauthorized traffic and information flows from less trusted networks into more trusted ones. That is why statement B is correct: by applying security policies, the firewall can block unauthorized access attempts and prevent unapproved data from the extranet reaching intranet resources.

The other statements are incorrect because they overstate firewall capabilities. A firewall alone cannot guarantee protection against zero-day vulnerabilities, because zero-days may not match known signatures or rule patterns, and prevention often requires multiple layers such as endpoint hardening, behavioral detection, and timely patching. It also cannot defend against all external threats, since attacks can bypass controls through encrypted traffic, insider misuse, misconfigurations, or compromised endpoints. Even if a firewall supports antivirus features, it does not replace endpoint and network antivirus deployment; layered security is still required.