Which of the following descriptions about firewall bandwidth policies is correct?

Question

Options

• AIn the same group of parent-child policies, the same bandwidth channel can be referenced
• BBy default, there is a default bandwidth policy on the firewall. The configured conditions are all
• CIf bandwidth management is used together with the source NAT function, the address before
• DFor maximum bandwidth and connection limit, the child policy can be larger than the parent policy

• A
  5% (1)
• B
  10% (2)
• C
  81% (17)
• D
  5% (1)

Explanation

Option C is correct because when bandwidth management is configured alongside source NAT, the firewall matches traffic against the original (pre-NAT) source address, not the translated one. This matters because NAT address translation occurs after policy matching in the processing pipeline, so the bandwidth policy sees the real internal IP, ensuring correct classification and enforcement.

Why the distractors are wrong:

• A is wrong: In a parent-child policy group, the same bandwidth channel cannot be referenced by multiple policies simultaneously - each policy must reference its own channel to prevent allocation conflicts.
• B is wrong: Firewalls do not have a default bandwidth policy out of the box; bandwidth management must be explicitly created and configured by an administrator.
• D is wrong: Child policies cannot exceed the parent policy's limits for maximum bandwidth or connection counts - the parent defines the ceiling, and children can only allocate portions within that boundary. This is a core constraint of hierarchical bandwidth management.

Memory tip: Think of the parent-child bandwidth relationship like a household budget - children can only spend what the parent allocates, never more. And for NAT + bandwidth, remember "match first, translate second" - the firewall always sees the original address when applying policies.

No community discussion yet for this question.