A firewall policy contains a broad allow network rule for outbound TCP 443 and a more restrictive HTTP application rule for the same destination traffic. Why might the application restriction not be evaluated as intended?

1. A DNS TXT record has higher priority than every firewall rule
2. A matching network rule can accept the traffic before application-rule evaluation
3. Rule order is based only on alphabetical collection names
4. Application rules always override every network allow regardless of evaluation order