350-701 Question 74

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  D is correct

• 5

  D Rules For Zone-Based Policy Firewall Application Router network interface memberships in zones is subject to several rules that govern interface behavior, as is the traffic that moves between zone member interfaces: A zone must be configured before interfaces can be assigned to the zone. An interface can be assigned to only one security zone. All traffic to and from a given interface is implicitly blocked when the interface is assigned to a zone, except traffic to and from other interfaces in the same zone, and traffic to any interface on the router. Traffic is implicitly allowed to flow by default among interfaces that are members of the same zone. In order to permit traffic to and from a zone member interface, a policy that allows or inspects traffic must be configured between that zone and any other zone. The self-zone is the only exception to the default deny all policy. All traffic to any router interface is allowed until traffic is explicitly denied.

• 1

  D correct!! https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/98628-zone-design-guide.html#anc11