Difference between firstmatchcodegroup and unioncodegroup?

Question

What is the difference between these a unioncodegroup and firstmatchcodegroup?

I have this question in an exam paper:

Ensure that all loaded assemblies default to the nothing permission set. Also ensure that when an asembly with comes from a trusted zone, you grant it a full permission set.

The answer is:

PermissionSet ps = new PermissionSet(PermissionState.None);

FileIOPermission rootFilePermissions = 
  new FileIOPermission(PermissionState.None);

// This permission set now has fileiopermission with no access/permission
ps.AddPermission(rootFilePermissions);

// Take set of permissions
PolicyStatement policy = new PolicyStatement(ps);

// All membership condition for all assemblies, regardless of zone. 
// No trust for any of these (as policy object will dictate)
CodeGroup cgroup = new FirstMatchCodeGroup(
  new AllMembershipCondition(), policy);

CodeGroup cgroup2 = new UnionCodeGroup(
  new ZoneMembershipCondition(SecurityZone.Trusted), policy);

cgroup.AddChild(cgroup2);

How do I know when to use one type of code group over another?

Thanks