In a standard three-zone perimeter firewall deployment (Internal, DMZ, and Internet), select ALL traffic flow directions that security best practices strictly disallow by default to prevent a compromised server from initiating connections into the trusted local network.

### Why this is right - **Internal to DMZ** is true: this is the first policy created in the lab. - **Internal to Internet** is true: the lab asks for a rule allowing this direction. - **DMZ to Internet** is true: the lab asks for a separate rule for this direction. - **Internet to DMZ** is true: the lab asks for this policy when testing Internet access to the web server. ### The concept The direction in a policy is identified by its source and destination zones. These rules do not all serve the same purpose: Internet-to-DMZ policy permission is needed for access, while Destination NAT later maps the public-facing address to the DMZ server. The lab does not instruct students to create a general DMZ-to-Internal rule. ### The other options - **E. DMZ to Internal**: the lab warns that allowing this direction can pose a security risk and does not request that rule. ### Terms - **DMZ**: Demilitarized Zone. A network segment used for services accessible from less trusted networks. ### Remember List policy directions explicitly; do not assume a rule works both ways.