In a Next-Generation Firewall (NGFW) security policy rule, what is the effect of setting the Service field to 'application-default'?

### Why this is right - **Source zone is Internal** is true: the rule permits traffic originating in Internal. - **Destination zone is DMZ** is true: the rule targets the DMZ network. - **Application is Any** is true: the lab instructs students to leave the application setting as Any. - **Service setting is application-default** is true: this is the selected service behavior in the lab. ### The concept A security rule combines fields that describe traffic with an action that decides what the firewall does with matching traffic. `Any` for an application is broad, while `application-default` limits the service to the default service associated with the identified application. In the lab's rule, the action is Allow, so a matching packet is permitted. ### The other options - **D. Action is Deny**: the lab explicitly selects Allow. Deny would block matching traffic. ### Terms - **Application-default**: A service setting that uses the default service associated with an application. ### Remember Check the source, destination, match conditions, and action separately when reviewing a policy.