A firewall has Security policies from three sources: 1. locally created policies 2. shared device group policies as pre-rules 3. the firewall's device group as post-rules How will the rule order…

Question

Options

• Ashared device group policies, firewall device group policies, local policies.
• Bfirewall device group policies, local policies, shared device group policies
• Cshared device group policies, local policies, firewall device group policies
• Dlocal policies, firewall device group policies, shared device group policies

• A
  4% (1)
• B
  8% (2)
• C
  83% (20)
• D
  4% (1)

Explanation

In Panorama, security policy rules are evaluated in a strict hierarchy when pushed to managed firewalls: Shared pre-rules → Device group pre-rules → Local (firewall-level) rules → Device group post-rules → Shared post-rules. In this scenario, the shared device group policies are configured as pre-rules, the local policies are firewall-level rules, and the firewall's own device group policies are post-rules. This maps directly to the order: shared device group (pre-rules) → local policies → firewall device group (post-rules), which is answer C. Pre-rules from higher levels always take precedence over local rules, which in turn take precedence over post-rules from higher levels.

No community discussion yet for this question.