A 200-user branch WAN Edge runs two transports and hosts trusted LAN in VPN 10 and guest Wi-Fi in VPN 20. Compliance requires application-aware inspection between zones, logging of denied sessions, and default deny between VPNs. Which zone-based firewall design enforces application-aware segmentation on the WAN Edge?
Select an answer to reveal the explanation.
Short Explanation
You get segmentation right when every VPN lives in its own zone. Pairing zones with application-aware rules and default deny keeps trusted and guest apart cleanly.
Full Explanation
The correct design enforces segmentation by placing trusted LAN VPN 10 and guest VPN 20 in separate zones so all inter-VPN traffic must traverse a zone-pair where application identity inspection permits only approved applications, while the default action drops everything else and logs each denied session to satisfy default-deny and audit requirements on the WAN Edge. The shared trust zone approach fails on segmentation logic because traffic within the same zone bypasses zone-pair inspection, so guest-to-trusted lateral movement is unfiltered despite application control, default deny, and denied logging outward, a consolidation tactic for large deployments but invalid when compliance mandates inspection between VPNs. The default-permit with deny exceptions approach fails on security posture because allowing all except known risky applications permits new, evasive, or tunneled apps until blocked, violating default-deny despite correct zoning, application awareness, and exception logging. The allowed-session logging approach fails on visibility because recording only permitted flows proves what was allowed, not what was blocked, preventing verification that denials were dropped and investigated despite correct zoning, control, and deny action. Exam caveat is to read default action and log objects carefully rather than choosing on application-aware and zone keywords alone, since wording about analytics, exception rules, or simplified zoning often masks the missing element. Practical check is to verify zone membership per VPN interface, confirm the VPN 10 to VPN 20 pair uses application matches with drop default and log on drop, then test guest-to-trusted apps to confirm allowed apps pass while others appear as denied sessions with application, zones, and timestamps.