A regional hospital is refreshing core, distribution, and access switches and wants IPv6 end-to-end where possible. Printers and an old imaging system remain IPv4-only, and the team wants one operational model plus consistent ACLs and monitoring. Which native dual-stack design best meets the IPv6 migration requirement?

The correct design succeeds because enabling both families natively on every routed interface preserves IPv6 end-to-end where possible while retaining native IPv4 for printers and the legacy imaging system, and parallel addressing, routing, and security policies deliver one operational model with consistent ACLs and monitoring across core, distribution, and access. Limiting dual-stack to core and distribution with overlay tunnels toward access keeps the backbone modern but fails end-to-end nativity because encapsulation at the edge adds overhead, fragments troubleshooting, and prevents uniform policy enforcement where endpoints actually connect. Operating both protocols on all interfaces yet managing them with separate ACL and monitoring platforms forwards correctly but violates unified operations because duplicated tooling doubles effort and allows IPv4 and IPv6 controls to drift, undermining audit consistency required in a hospital. Deploying IPv6 everywhere and proxying legacy devices through application gateways provides logical reachability but abandons native parallel forwarding by inserting stateful intermediaries with limited application support and asymmetric behavior contrary to the native requirement. For exams, treat native dual-stack as parallel independent forwarding and be wary of attractive designs that tunnel, translate, or proxy one family, since they sacrifice either nativity or operational unity. In practice, verify interface addresses, multiprotocol routing adjacencies, mirrored ACL entries, and flow telemetry for both families on each tier before acceptance.