If users from the Trusted zone need to allow traffic to an SFTP server in the DMZ zone, how should a Security policy with App-ID be configured?

Specifying 'Application: any' defeats the purpose of App-ID by allowing any application on the SFTP port, making the policy less secure.

Configuring the 'Application' as 'sftp' leverages App-ID to identify SFTP traffic regardless of its port, while setting 'Service' to 'application-default' ensures the policy matches SFTP on its standard port (TCP/22) or any other port App-ID detects it on, providing robust control from the Trusted to the DMZ zone.

Setting 'Service' to 'any' is less secure than 'application-default' as it allows the application on any port without App-ID's default port enforcement.

Using 'Application: any' with 'Service: application-default' is overly permissive, allowing any application on its default port, which is not suitable for a specific SFTP allowance.