At which stage of the cyber-attack lifecycle would the attacker attach an infected PDF file to an email?

Match the cyber-attack lifecycle stage to its correct description.

Recently changes were made to the firewall to optimize the policies and the security team wants to see if those changes are helping.
What is the quickest way to reset the hit counter to zero in all the security policy rules?

An internal host wants to connect to servers of the internet through using source NAT.
Which policy is required to enable source NAT on the firewall?

Based on the security policy rules shown, ssh will be allowed on which port?