What happens if no match is found in both zone-based and global security policies?

SRX devices operate on a default deny-all policy if no explicit match is found:

If a packet does not match any configured zone-based or global policy, it is implicitly denied.

The traffic is discarded silently by the default security policy (Option A).

Option B: No predefined “safe zone” exists.

Option C: Logging occurs only if explicitly configured; default deny does not automatically log traffic.

Option D: Incorrect, since the firewall defaults to deny, not permit.

Correct Behavior: Traffic is discarded by the default security policy.