Which two statements about the application control profile mode are true? (Choose two.)

Application control is a core security feature in FortiOS that identifies and controls applications on a network. It is fundamentally a flow-based feature, leveraging the Intrusion Prevention System (IPS) engine for its scanning and detection mechanisms. Consequently, even when an application control profile is applied to a firewall policy configured in proxy-based inspection mode, the actual application scanning is still performed by the flow-based IPS engine. From a configuration standpoint, the application control profile is available for selection and can be applied to a firewall policy regardless of whether the policy's inspection mode is set to flow-based or proxy-based.

B. It cannot be used in conjunction with IPS scanning. This is incorrect. Application control and IPS are designed to work together in the same firewall policy to provide layered security, with application control identifying the application and IPS inspecting for threats within that application's traffic.
D. It can scan only unsecure protocols. This is incorrect. When combined with SSL/SSH deep inspection, application control can effectively identify and control applications that use encrypted protocols, such as HTTPS, which is essential for modern network security.

1. Fortinet Certified Professional - Security Operations 7.2 Study Guide, Chapter 4: Application Control, Page 116: "Application control is a flow-based feature. Even if you apply an application control profile to a proxy-based policy, FortiGate uses the IPS engine to scan the traffic." This statement directly supports option A.

2. FortiOS 7.2.0 Administration Guide, Security Profiles > Application Control > Application Control overview, Page 1018: "Application control uses the IPS engine to perform application detection..." This confirms the reliance on the flow-based IPS engine.

3. FortiOS 7.2.0 Administration Guide, Firewall > Firewall policies > To create or edit a firewall policy, Page 618: The firewall policy configuration settings show that "Application Control" is a selectable security profile regardless of whether the "Inspection Mode" is set to "Flow-based" or "Proxy-based". This supports option C.

4. FortiOS 7.2.0 Administration Guide, Security Profiles > SSL/SSH Inspection, Page 1118: "SSL inspection can be applied to firewall policies to allow FortiGate to inspect encrypted traffic for threats." This demonstrates that security profiles, including application control, can inspect secure protocols, refuting option D.