At which point in the app-ID update process can you determine if an existing policy rule is affected by an app-ID update?

Based on the screenshot what is the purpose of the included groups?

Refer to the exhibit. A web server in the DMZ is being mapped to a public address through DNAT.

Which Security policy rule will allow traffic to flow to the web server?

An administrator is configuring a NAT rule
At a minimum, which three forms of information are required? (Choose three.)

The compliance officer requests that all evasive applications need to be blocked on all perimeter firewalls out to the internet. The firewall is configured with two zones:
1. trust for internal networks
2. untrust to the internet
Based on the capabilities of the Palo Alto Networks NGFW, what are two ways to configure a security policy using App-ID to comply with this request? (Choose two )