An administrator has configured a Zone-Based Firewall (ZBFW) policy on a branch ION.

Comprehensive and Detailed Explanation

In Prisma SD-WAN, security policies can be applied viaPolicy Stacks, which often have a hierarchy.

Stack Precedence:A common configuration involves aGlobal Security Stack(applied to all sites) and aLocal/Site Security Stack(specific to one site). If the administrator configured a "Global" rule that says "Deny Access to Gambling Sites" (or a specific IP list), and that rule is higher in the binding order or part of a higher-priority stack, it will enforce the blockbeforethe local "Allow Guest to Internet" rule is processed.

Specifics of "REJECT":The state REJECT specifically implies a policy enforcement action (sending a TCP RST or ICMP Unreachable) rather than a silent drop or a routing failure.

Why not A?If the "Allow" rule is at the top and matches the traffic parameters (Zone/IP), the Default Deny at the bottom would never be reached. The issue implies ahigher priorityDeny exists.