If both a security rule and an Application & URL Filtering rule match, which one has higher priority?

A.
In the first place there must always be a matching security rule; only if the traffic is allowed, the
Application & URL Filtering policy will be processed.

B.
It does not matter which rule will be processed first.

C.
If the Application & URL Filtering rule has an “Allow” action, it will be applied before the security rule.

D.
If either of the rules uses an Access Role in the source field, the security rule has higher priority.