300-710 SNCF: Securing Networks with Cisco Firewalls

Access-control rules match traffic based on their configured source and destination security zones, which correspond to the interfaces through which traffic enters and exits the device. Selecting the wrong source interface prevents the intended traffic from matching the rule, so the rule does not take effect and its hit counter remains zero. Logging settings do not determine rule hit counts.