Rules E-1.1 and E-1.2 are exceptions that can change the final decision (Inactive, Prevent, Detect) of what to do only if rule 1 is matched. If rule 1 is not matched, E-1.1 and E-1.2 are skipped. Overall in the Threat Prevention layers just the first matching rule is taken, unless there is more than one Threat Prevention policy layer (not common), in which case the first matching rule is selected in all TP layers, and the most stringent action wins unless there is an exception which changes it.
Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com