A firewall engineer is migrating port-based rules to application-based rules by using the Policy Optimizer. The engineer needs to ensure that the new application-based rules are future-proofed, and that they will continue to match if the existing signatures for a specific application are expanded with new child applications. Which action will meet the requirement while ensuring that traffic unrelated to the specific application is not matched?
Using Policy Optimizer to migrate to application-based rules, adding the container application (Option D) ensures future-proofing. Container apps (e.g., 'web-browsing') include child apps (e.g., specific web services) as signatures evolve, maintaining rule accuracy without over-matching unrelated traffic.
Option A (custom app with ports) reverts to port-based logic, losing App-ID benefits. Option B (application filter) risks overbroad matching (e.g., by category). Option C (specific apps) lacks flexibility for new child apps. Documentation supports container apps for this purpose.