On a Palo Alto Networks firewall, what happens to interzone traffic when no security policy allows it?

### Why this is right A security policy must allow traffic between zones. When no rule permits it, the firewall's default interzone behavior is to deny it. ### The concept A zone groups network interfaces according to their security role, such as Internal, DMZ, or Internet. Security policies control traffic between these zones. Network Address Translation (NAT) changes packet addresses, but it does not itself grant permission for traffic to pass. An administrator needs to consider both policy and address translation when designing connectivity. ### The other options - **B. It is automatically translated to a public address**: translation is a NAT function, not the default action for denied traffic. - **C. It is allowed if the destination host responds**: a reply cannot make a denied initial connection permissible. - **D. It is sent to the DMZ zone**: zone membership and routing do not replace a policy decision. ### Terms - **DMZ**: Demilitarized Zone. A network segment used for services that may need access from less trusted networks. - **NAT**: Network Address Translation. A process that modifies packet address information. ### Remember A route tells traffic where it can go; a security policy determines whether the firewall allows it.