Which two statements about incoming and outgoing interfaces in firewall policies are true? (Choose two.)

FortiGate firewall policies require the definition of a traffic path, which includes both an incoming (source) and an outgoing (destination) interface. The FortiOS architecture provides flexibility by allowing administrators to select multiple interfaces within a single policy for either the incoming or outgoing traffic direction. Furthermore, to simplify administration and policy management, multiple interfaces can be grouped into a logical object called a "zone." This zone can then be used as either the incoming or outgoing interface in a policy, applying the rule to all member interfaces simultaneously.

A. You must select a specific interface, a zone, or "any"; "any" is an option but not the only one, making this statement false.

B. Both incoming and outgoing interfaces are mandatory components for a standard firewall policy to control traffic flow from a source to a destination.

1. Fortinet FortiOS 7.4.0 Administration Guide

Firewall policies > Creating a firewall policy

Page 638: "Incoming Interface: Select the interface that the traffic is coming from. You can select one or more interfaces or zones." and "Outgoing Interface: Select the interface that the traffic is going to. You can select one or more interfaces or zones." This directly confirms that multiple interfaces (C) and zones (D) can be selected for both fields. It also implicitly refutes options A and B.

2. Fortinet FortiOS 7.4.0 Administration Guide

Network > Zones

Page 381: "A zone is a group of one or more FortiGate interfaces... After you create a zone

you can use the zone as the source or destination interface in a firewall policy... This simplifies the creation of firewall policies." This source explains the concept of a zone and its use in firewall policies

supporting option D.