In a zone-based firewall, a security policy rule that specifies only the Internal zone as its source zone does not permit traffic originating from the DMZ zone.

### Why this is right The lab instructs students to create one rule for Internal to Internet and another for DMZ to Internet. Each rule identifies a different source zone. ### The concept A security policy describes traffic using its source and destination zones, among other fields. Separate rules make the intended access paths visible and independently reviewable. This policy permission is distinct from Source Network Address Translation (Source NAT), which the lab also needs for Internet access. ### Terms - **Source NAT**: Source Network Address Translation. Translation that changes a packet's source address. ### Remember A rule for one source zone does not automatically cover a different source zone.