What are two features of the NGFW profile-based mode? (Choose two.)

NGFW profile-based mode is the traditional and more granular method for configuring security on a FortiGate. Its defining feature is the use of separate security profiles (such as Application Control, Web Filtering, Antivirus, and IPS) which are then applied to a firewall policy. This allows for reusable and detailed security configurations. Furthermore, within these security profiles, administrators can select the inspection method—either flow-based for high performance or proxy-based for more thorough inspection. Therefore, a firewall policy in profile-based mode can leverage both inspection methods depending on the attached profiles.

A. NGFW mode is a setting configured on a per-VDOM basis, not globally. Different VDOMs on the same FortiGate can operate in different NGFW modes. B. Central Source NAT (SNAT) is an optional feature that can be used in either NGFW mode but is not a requirement for profile-based mode.

1. Fortinet FortiOS 7.0.0 Administration Guide, Page 58, "NGFW mode":

"In profile-based NGFW mode, you can apply all security profiles to a firewall policy." (Supports option D)

"You can configure NGFW mode for each VDOM." (Refutes option A)

2. Fortinet FortiOS 7.0.0 Administration Guide, Page 59, "Inspection mode":

"FortiOS can apply antivirus and web filtering in flow-based or proxy-based inspection mode. In profile-based NGFW mode, you can select the inspection mode when you configure the Antivirus and Web Filter security profiles." (Supports option C)

3. Fortinet FortiOS 7.0.0 Administration Guide, Page 1000, "Central SNAT":

The guide describes Central SNAT as a separate policy table that can be enabled. It is not presented as a prerequisite for profile-based NGFW mode, where NAT is typically configured within the firewall policy itself. (Refutes option B)