A clinic WAN Edge terminates guest Internet, clinical VPN traffic, and a service VPN, needs application-aware inspection between zones, and must deny inter-zone traffic by default. Which zone-based enterprise firewall design best meets this WAN Edge security requirement?

The correct design succeeds because it binds each WAN Edge termination to its own security zone, applies application identification rather than ports alone, and enforces an explicit zone-pair matrix where only required traffic is permitted and all else is denied, satisfying segmentation, visibility, and least privilege for guest, clinical, and service contexts. The stateful port-based design is common for performance and simplicity but fails on inspection concept because ports no longer map reliably to applications with tunneling, SaaS, and evasive behavior, so unwanted clinical or guest traffic can pass despite default deny. The verified-session design correctly covers all interfaces with application awareness yet fails on authorization concept because permitting authenticated sessions with logging replaces deterministic default deny and explicit source-to-destination rules with broad trust, enabling unintended lateral movement once identity validates. The guest-and-clinical-only design correctly implements zones, application awareness, and default deny but fails on scope concept because excluding the service VPN from edge enforcement leaves a terminated trust boundary uninspected and violates the requirement to protect every zone at that edge. Exam caveat: logging, authentication, or stateful filtering never substitute for an explicit deny-by-default inter-zone matrix with application control, and separate management does not equal zone enforcement. Practical check: audit the zone-pair table to confirm each permitted application with source and destination zones, then generate unauthorized inter-zone and service-VPN traffic to verify denial and application logging.