A cooperative is designing IPv6 addressing for its internal back-office network — device management interfaces, NOC servers, and internal monitoring links that must never be reachable from the public internet. Which type of IPv6 address is the appropriate choice for this internal-only addressing plan?

Unique local addresses, drawn from the fc00::/7 range, are designed for exactly this use case: they route normally within a private network across multiple internal subnets and routers, but are not intended to be advertised to or reachable from the public internet, closely mirroring the role RFC 1918 private space plays in IPv4. The link-local option is incorrect because fe80::/10 addresses are scoped to a single local segment only; they cannot be routed between different subnets or POPs, making them unsuitable for a network that spans multiple internal links. The global-unicast option is technically routable but is the wrong tool for a network the cooperative explicitly wants to keep off the public internet; using public-routable space for internal-only infrastructure would require careful filtering to avoid accidental exposure, which unique local space avoids by design. The multicast option fundamentally misunderstands address types: multicast addresses identify a group of interfaces to be reached together, not a single device's unique identity, so a server cannot be "assigned" a multicast address as its own address. An operational check when planning internal IPv6 addressing is to confirm the chosen prefix falls within fc00::/7 and that no route advertising that prefix is exported toward the internet-facing transit peer.