Refer to Cisco IOS Zone-Based Policy Firewall, where will the inspection policy be applied?

A.
to the zone-pair

B.
to the zone

C.
to the interface

D.
to the global service policy

Explanation:
Zone-based policy firewall (also known as “Zone-Policy Firewall” or “ZPF”) changes the firewall
from the older interface-based model to a more flexible, more easily understood zone-based
configuration model. Interfaces are assigned to zones, and an inspection policy is applied to traffic
moving between the zones. Inter-zone policies offer considerable flexibility and granularity, so
different inspection policies can be applied to multiple host groups connected to the same router
interface.
The following task order can be followed to configure a Zone-Based Policy Firewall:
1.
Define zones.
2.
Define zone-pairs.
3.
Define class-maps that describe traffic that must have policy applied as it crosses a zone-pair.
4.
Define policy-maps to apply action to your class-map’s traffic.
5.
Apply policy-maps to zone-pairs.
6.
Assign interfaces to zones.
Reference:
http://www.cisco.com/c/en/us/td/docs/routers/access/cisco_router_and_security_device_manager/
24/software/user/guide/ZPF.html