In what order are NSX-T Distributed Firewall rules processed?

Users on iOS and Android devices are being prompted for their credentials when accessing an application protected by Workspace ONE Access.
The current configuration includes:
Workspace ONE UEM is integrated with Workspace ONE Access
Workspace ONE UEM has a Certificate Authority configured
Single sign-on has been enabled through device profiles
What authentication method can be used to allow iOS and Android devices to launch an application without being prompted for credentials?

Which three statements are true about NSX Intelligence and vRealize Network Insight? (Choose three.)

In a Workspace ONE environment, which two Risk Indicators are supported on the Windows 10 & MacOS platforms? (Choose two.)