Which data flow direction is protected in a zero trust firewall deployment that is not protected in a perimeter-only firewall deployment?

Refer to the exhibit. An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) receives HTTP traffic and Host B (10.1.1.101) receives SSH traffic.

Which two Security policy rules will accomplish this configuration? (Choose two.)

The firewall sends employees an application block page when they try to access Youtube.
Which Security policy rule is blocking the youtube application?

Which action related to App-ID updates will enable a security administrator to view the existing security policy rule that matches new application signatures?

A security administrator has configured App-ID updates to be automatically downloaded and installed. The company is currently using an application identified by App-ID as SuperApp_base.
On a content update notice, Palo Alto Networks is adding new app signatures labeled SuperApp_chat and SuperApp_download, which will be deployed in 30 days.
Based on the information, how is the SuperApp traffic affected after the 30 days have passed?