A virtual service is configured with an HTTP Security policy, Network Security policy, DataScript Response policy, and an HTTP Request policy. In which order will these be evaluated?

Question

Options

• ANetwork Security -> HTTP Security -> HTTP Request -> DataScript Response
• BNetwork Security -> HTTP Request -> HTTP Security -> DataScript Response
• CHTTP Security -> Network Security -> HTTP Request -> DataScript Response
• DDataScript Response -> Network Security -> HTTP Request -> HTTP Security

• A
  95% (20)
• C
  5% (1)

Explanation

Option A is correct because Avi Networks (NSX Advanced Load Balancer) evaluates policies in a logical, layered order that mirrors the network stack: Network Security fires first at L3/L4 before the traffic is even inspected at L7, then HTTP Security checks the request for threats or access rules, followed by HTTP Request policies that can modify or redirect the request, and finally DataScript Response runs on the return path after the server replies.

Option B is wrong because it swaps HTTP Security and HTTP Request - security screening must occur before request manipulation, not after. Option C is wrong because it places HTTP Security ahead of Network Security, which violates the principle that lower-layer (L3/L4) controls gate traffic before higher-layer (L7) policies even see it. Option D is wrong because it places DataScript Response first, which is nonsensical - response-phase logic cannot run before the request has been processed and a backend has replied.

Memory tip: Think of the acronym "NS-HS-HR-DR" - "No Hackers Here, Dude Responds". Alternatively, remember that policies follow the request lifecycle in order (network → security → request handling) and DataScript Response is always last because it only fires on the way back from the server.

No community discussion yet for this question.