A security policy allowing traffic from the Internal zone to the DMZ zone also allows a DMZ host to initiate traffic to an Internal host.

### Why this is right The rule specifies Internal as the source zone and DMZ as the destination zone. It does not grant permission for a new connection initiated in the opposite direction. ### The concept A policy's source and destination zones describe the direction of the traffic it governs. A permitted connection may have return traffic handled as part of that connection, but that is different from allowing the destination host to start a separate connection back toward the source network. The lab tests this distinction by allowing Internal-to-DMZ traffic while not creating a reverse DMZ-to-Internal rule. ### The other options - **True**: this would be true only if a policy or other applicable rule permitted DMZ-initiated traffic to Internal. ### Terms - **Source zone**: The security zone from which a packet enters the firewall. - **Destination zone**: The security zone toward which the packet is being sent. ### Remember Read a policy direction as source zone to destination zone; do not reverse it.