An engineer configures a Security policy for traffic originating at branch locations in the Remote...

This scenario is a direct extension of the rule-hierarchy precedence behavior that governs Strata Cloud Manager policy evaluation: rules defined at the broader, parent Prisma Access configuration scope are evaluated ahead of rules defined in a more specific child scope such as Remote Networks. If a rule already exists at the Prisma Access scope that matches the same branch traffic — commonly a broad, catch-all allow rule intended for a different purpose — that higher-scope rule will be hit first and policy lookup will terminate there, meaning the newly created Remote Networks-scoped rule is never reached or evaluated at all, even though it is correctly configured. This is exactly what option D describes, and it is the most common, documented explanation for a properly built rule that appears to have no effect on the traffic it was intended to control. Option A describes a plausible but self-defeating configuration mistake (an address object matching the traffic that should be scoped correctly) but does not, by itself, explain complete non-matching behavior the way scope precedence does. Option B, an incorrectly assigned " Trust " source zone, would typically cause a rule to not match due to zone mismatch, but the scenario states the rule is properly scoped to Remote Networks traffic, making this a less direct explanation. Option C describes an automated removal behavior that does not exist in the platform — non-compliant rules are flagged for review, they are not silently deleted.