Explain how a Palo Alto Security Policy is evaluated — top-down rule processing.

Palo Alto firewalls evaluate security policies sequentially from top to bottom, stopping at the first matching rule. Each session is checked against rules in order: source zone, destination zone, application, service, and user. Once a match occurs, the action (allow/deny/drop) is applied and no further rules are evaluated. The default interzone rule at the bottom denies all traffic. Interview tip: Bangalore employers like Cisco India and Aryaka expect you to explain why rule order matters — placing broad permit-any rules at the top breaks security posture. Always position specific deny rules above general allow rules.