Regarding the firewall inter-domain security policy, which of the following statements is correct?

Question

Options

• AIf no conditions are defined in the policy and only actions are defined, the policy will match any
• BIf the packet matches the inter-zone security policy, and the security policy allows the packet to
• CIf the packet does not match the inter-zone security policy and the default inter-zone packet
• DAll the above statements are correct

• A
  6% (1)
• B
  83% (15)
• C
  11% (2)

Explanation

Option B correctly describes the fundamental operation of firewall security policies: when a packet matches an inter-zone policy rule and that rule's action is set to permit, the firewall forwards the packet to its destination - this is the basic permit-flow behavior all security policies are built around.

Option A is incorrect because a policy with no match conditions is essentially undefined or inactive in most firewall implementations (such as Huawei USG series); an action alone does not create a valid catch-all rule - conditions (source/destination zone, address, service) must be configured for the policy to take effect.

Option C is wrong because even if the default inter-zone action is "deny," the statement misrepresents why the packet is dropped - the packet isn't dropped due to "not matching," it's dropped because it hits the implicit default deny rule, a subtle but exam-critical distinction.

Since A and C contain inaccuracies, D (all of the above) is also wrong.

Memory tip: Think of firewall policy as a checklist - Match + Permit = Forward, Match + Deny = Drop, No Match = Default Deny. If the "Match" condition isn't properly defined, the rule never fires, making A false.

No community discussion yet for this question.