Which option best describes why firewall policies are preferred over a simple ACL list?

• A. Both A and B
• B. Policies are easier to understand.
• C. Neither A nor B
• D. Policies are more specific.

Answer: (B)

The main idea here is that firewall policies are easier to understand and manage than a long ACL list. A policy framework organizes rules into coherent groups—often around zones, user/role, service, and intent—with clear allow or deny actions and a defined default behavior. This makes it much easier to see why traffic is permitted or blocked, trace how a decision was reached, and update the rules without having to sift through a maze of individual entries.

ACLs, while potentially very specific, tend to become unwieldy as the network grows. They require careful attention to rule order, since a single rule can unintentionally override or shadow others, leading to troubleshooting headaches. Maintaining consistency, documenting intent, and auditing changes in a large ACL list is harder than in a well-structured policy set.

So, while both approaches can express specific traffic controls, the standout benefit of firewall policies is their readability and manageability, which is why they’re preferred.