A university WAN Edge hosts student VPN 30, research VPN 40, and Internet transport in VPN 0. Policy requires research traffic to pass inspection before Internet breakout, student peer traffic blocked, and zones tied to VPN membership. Which zone-based firewall design enforces the application-aware inspection requirement?

The correct design aligns zone membership with VPN segmentation so student VPN 30, research VPN 40 and transport VPN 0 each reside in distinct trust domains, then enforces a directional inspect action from research toward transport which provides stateful tracking plus application-aware processing such as DPI, IPS, URL filtering and TLS proxy before Internet breakout, thereby satisfying both segmentation and compliance inspection in the intended north-south path. The student-to-transport inspect variant fails by concept of traffic selectivity because it secures the wrong source VPN and leaves research egress to the Internet without mandated inspection even though zoning and action type are correct. The research-to-student inspect variant fails by concept of zone-pair directionality because inter-VPN east-west control does not substitute for research-to-transport north-south breakout control, so Internet egress remains uninspected. The within-student-zone inspect variant fails by concept of intra-zone versus inter-zone scope and required verdict because student peer traffic must be denied, not conditionally permitted with deep inspection, and intra-zone handling cannot enforce egress inspection. Exam caveat: distinguish pass as basic stateful permit from inspect as application-layer enforcement and always map source zone to originating VPN and destination zone to egress transport with correct sequence order. Practical check: verify zone-to-VPN bindings, commit the zone-based policy, then generate research Internet traffic and student peer attempts while reviewing firewall counters, inspect engine logs and drop statistics to confirm allowed inspected breakout and denied peer flows.