which three types of traffic are permitted by the route…

With Cisco IOS zone-based policy firewall, by default, which three types of traffic are
permitted by the router when some of the router interfaces are assigned to a zone? (Choose
three.)

A.
traffic flowing between a zone member interface and any interface that is not a zone member

B.
traffic flowing to and from the router interfaces (the self zone)

C.
traffic flowing among the interfaces that are members of the same zone

D.
traffic flowing among the interfaces that are not assigned to any zone

E.
traffic flowing between a zone member interface and another interface that belongs in a
different zone

F.
traffic flowing to the zone member interface that is returned traffic

Explanation:
http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a0080
8bc994.shtml
Rules For Applying Zone-Based Policy Firewall
Router network interfaces’ membership in zones is subject to several rules that govern
interface behavior, as is the traffic moving between zone member interfaces:
A zone must be configured before interfaces can be assigned to the zone. An interface can
be assigned to only one security zone. All traffic to and from a given interface is implicitly
blocked when the interface is assigned to a zone, except traffic to and from other interfaces in
the same zone, and traffic to any interface on the router.
Traffic is implicitly allowed to flow by default among interfaces that are members of the same
zone. In order to permit traffic to and from a zone member interface, a policy allowing or
inspecting traffic must be configured between that zone and any other zone. The self zone is
the only exception to the default deny all policy. All traffic to any router interface is allowed
until traffic is explicitly denied. Traffic cannot flow between a zone member interface and any
interface that is not a zone member. Pass, inspect, and drop actions can only be applied
between two zones. Interfaces that have not been assigned to a zone function as classical
router ports and might still use classical stateful inspection/CBAC configuration. If it is
required that an interface on the box not be part of the zoning/firewall policy. It might still be
necessary to put that interface in a zone and configure a pass all policy (sort of a dummy
policy) between that zone and any other zone to which traffic flow is desired. From the
preceding it follows that, if traffic is to flow among all the interfaces in a router, all the

interfaces must be part of the zoning model (each interface must be a member of one zone or
another).
The only exception to the preceding deny by default approach is the traffic to and from the
router, which will be permitted by default. An explicit policy can be configured to restrict such
traffic.