where are the two optimal locations for trust boundaries to be configured by the network administrator?