What two ordered layers make up the Access Control Policy Layer?

URL Filtering is not a standalone ordered layer within Access Control; it is handled as part of the Application Control blade, not a separate first-position layer.

Threat Prevention is a separate policy layer entirely and is not a sub-layer within the Access Control Policy Layer.

Application Control and URL Filtering are functionally paired blades but do not represent the two distinct ordered layers of the Access Control Policy Layer.

In Check Point R80 and later, the Access Control policy layer contains a Network sub-layer that enforces basic firewall rules first, followed by an Application Control sub-layer that inspects application-level traffic. The order is significant because network-level rules are matched before application identity is used, allowing efficient policy evaluation and proper enforcement hierarchy.