For a DLP profile designed to prevent operational data from leaving the grid-operations segment toward the internet, which firewall policy is the correct place to attach it?
Select an answer to reveal the explanation.
Short Explanation
You'd station a guard at the door people are actually walking data out through, not at a door nobody uses for that. Attach DLP to the policy carrying the outbound path you're actually worried about.
Full Explanation
DLP only inspects traffic within the specific policy it is attached to, so protecting against data leaving the grid-operations segment requires binding the profile to the accept policy that actually permits that outbound direction — the path the exfiltration risk described in the question follows. The HA cluster management policy carries synchronization traffic between cluster members, which is unrelated to the data-leaving-the-segment path being defended. The inbound VPN policy for field technicians runs in the opposite direction — technicians connecting into the segment, not operational data leaving it — so a DLP profile there wouldn't see the traffic of concern at all. The default deny policy at the bottom of the list doesn't process security profiles the same way an accept policy does, since traffic reaching it is already being blocked rather than permitted through for inspection. A caveat: if more than one policy could carry that outbound path — for example, a secondary route or a policy covering a different destination range — each one needs the DLP profile attached, or traffic taking that alternate path bypasses inspection entirely. To confirm the binding is complete, trace a real outbound test transfer through the session log and verify which policy actually handled it, then confirm that policy — and only that one, if it's the sole path — carries the profile.