A and C

A. The expression is incorrect: If the policy expression does not correctly identify the traffic it is supposed to catch, then it will not trigger when that traffic is encountered. This is a common reason for a policy to have zero hits, indicating that the policy logic does not match the nature of the traffic. C. It is NOT bound to the virtual server: For a Web App Firewall policy to be evaluated, it must be bound to the virtual server handling the traffic for the web application. If it is not bound, the policy will not be applied, and no hits will be registered regardless of the traffic.