A company has a policy that denies all applications it classifies as bad and permits only application it classifies as good. The firewall administrator created the following security policy on the com

By having a distinct rule (e.g., Rule 3, a catch-all deny-all) with logging enabled, traffic that doesn't match known applications can be identified and logged as 'unknown' or 'insufficient-data', facilitating reporting on unclassified traffic for App-ID discovery.

While different security profiles can be applied to different rules, this is a general capability, and the specific benefit related to identifying unclassified traffic and granular logging is more direct for the scenario.

Security policy rules are primarily based on applications, not just ports, and the ability to specify ports is a general rule characteristic, not a specific benefit gained by these two rules in this context.

Separate Log Forwarding profiles can be applied to individual rules, allowing administrators to customize where and how logs from 'good' applications (Rule 2) and 'unclassified' traffic (Rule 3) are sent, such as to different syslog servers or with varying severity levels.