Click the Exhibit button.

Juniper SRX evaluatessecurity policiessequentially from top to bottom. Once a policy match is found, no further policies are evaluated. In this exhibit:

First Policy (FTP, deny):

Source: 172.25.11.0/24

Destination: 10.1.0.0/16

Application: FTP

Action: deny⇒Any FTP traffic from 172.25.11.0/24 to 10.1.0.0/16 isdenied.

Second Policy (SSH, permit):

Same source/destination but application = SSH

Action = permit⇒SSH traffic from 172.25.11.0/24 to 10.1.0.0/16 ispermitted.

Third Policy (HTTPS, permit):⇒HTTPS from the same source/destination ispermitted.

Fourth Policy (Ping, permit):

Source: 172.25.11.0/24 to any destination

Application: ping

Action: permit⇒ICMP echo requests (ping) from 172.25.11.0/24 to any destination arepermitted.

Fifth Policy (any → any, deny):⇒Serves as a defaultdeny allat the end.

Now checking each option:

Option A:SSH from 172.25.11.10 → 10.1.0.10 matches theSSH permit rule(second policy).✅Correct.

Option B:Ping from 172.25.11.100 → 10.1.0.10 matches theping permit rule(fourth policy). This traffic is permitted, not denied.❌Incorrect.

Option C:FTP from 10.1.0.10 → 172.25.11.100 isreverse traffic (untrust to trust). The table applies onlytrust → untrust, so this policy does not apply.❌Incorrect.

Option D:FTP from 172.25.11.11 → 10.1.0.10 matches the first policy (FTP deny rule).✅Correct.

Correct Statements:A, D