CCNP Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Applying an inspect action to a zone pair automatically creates a reverse zone pair for return traffic.

  Why it's wrong here

  The inspect action enables stateful tracking of sessions so return traffic for established flows is permitted, but it does not create a reverse zone pair. A reverse zone pair is a separate configuration object that must be defined explicitly if traffic initiation from the opposite direction is required. Confusing stateful return-traffic handling with automatic reverse zone pair creation is a common design error that leads to asymmetric policy gaps.

• ✓

  Traffic between two interfaces assigned to the same zone is implicitly permitted and not inspected by the zone policy.

  Why this is correct

  ZBFW treats all interfaces in the same zone as a single trust domain, so intra-zone traffic is not inspected and is permitted by default. This design simplifies policy by letting administrators define inspection only for inter-zone flows. In this scenario, if two branch-facing interfaces were both in the VPN zone, traffic between them would bypass inspection, which is a key behavior to understand when designing zone membership.

• ✗

  Interfaces not assigned to any zone are treated as members of the self zone and inspected.

  Why it's wrong here

  The self zone represents the router itself, not unassigned interfaces. Interfaces that are not assigned to any zone continue to use classic interface-based ACL behavior and are not inspected by ZBFW. Assuming unassigned interfaces join the self zone would leave traffic uninspected while the administrator believes it is protected, creating an unintended security gap in the branch router deployment.

• ✓

  Traffic between two zones with no configured zone pair is implicitly denied by default.

  Why this is correct

  ZBFW follows a default-deny model for inter-zone traffic: if no zone pair and policy exist between two zones, traffic is dropped. This is a security improvement over classic CBAC, which permitted traffic unless explicitly denied. In this scenario, the team must create explicit zone pairs (for example, inside-to-outside and VPN-to-inside) with inspect actions, or the corresponding traffic will be silently dropped.

• ✗

  A zone pair must be configured bidirectionally; a single zone pair covers traffic in both directions automatically.

  Why it's wrong here

  Zone pairs are unidirectional: a zone pair from inside to outside only matches traffic flowing in that direction. Return traffic is handled by the stateful inspection engine when an inspect action is applied, not by the reverse zone pair. Administrators who assume a single zone pair covers both directions will find that traffic initiated from the other zone is dropped unless a separate zone pair and policy are configured.