Explain why the lab checks the policy hit count and asks whether there is a reason to deny interzone traffic.

### What a good answer covers - A **hit count** records whether traffic has matched a policy rule, helping an administrator review rule use. - Unpermitted interzone traffic is denied by default, which prevents every zone from communicating freely. - A deny policy can express an intentional restriction or make policy intent easier to review; the material does not prescribe a specific deny rule. ### The concept A firewall uses rules to make traffic decisions rather than treating all networks as equally trusted. A hit count is evidence that a rule has matched traffic, but a count alone does not explain whether the rule is safe or necessary. Security policy review should consider the intended traffic, the rule's direction, and its action. ### Terms - **Interzone traffic**: Traffic moving from one firewall security zone to another. - **Hit count**: A rule statistic indicating that traffic has matched the rule. ### Remember Use hit counts to investigate rule use, and use policy review to decide whether that use is appropriate.