Exam PCNSA topic 1 question 194 discussion

The minute you took away any traffic, it was no longer UNIVERSAL. "Does not want to match traffic where the source and destination zones are LAN or DMZ" It was no longer INTRAZONE. That only left INTERZONE.

I've the evaluation tomorrow and read this example question. The answer is B, the question asks for the rule TYPE and we have three: Intrazone (within a zone), interzone (between zones) and universal (within and between zones).

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTHCA0

A security policy allowing traffic between the same zone, this applies the rule to all matching traffic within the specified source zones (cannot specify a destination zone for intrazone rules). For example, if setting the source zone to A and B, the rule would apply to all traffic within zone A and all traffic within zone B, but not to traffic between zones A and B.

Its b since its not going between zones.

It says that DNS traffic is allowed in LAN and DMZ zone. That traffic could come from outside zone, such as internet but it is not allowed between LAN and DMZ. According to this, I'd say is A because you only need to match Interzone areas.

Default

Why not C. Pls read carefully

Intrazone: A security policy allowing traffic between the same zone, this applies the rule to all matching traffic within the specified source zones (cannot specify a destination zone for intrazone rules). For example, if setting the source zone to A and B, the rule would apply to all traffic within zone A and all traffic within zone B, but not to traffic between zones A and B.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClomCAC