An administrator is comparing the ACCEPT and DENY actions available on a FortiGate firewall policy and wants to understand how each action affects traffic handling and what can be attached to the policy. Which statements correctly describe the behaviour of these two policy actions? Select TWO.
- AA policy with the action set to ACCEPT permits the matching traffic and can have security profiles such as antivirus and web filter attached to inspect it. Correct
- BA policy with the action set to DENY drops the matching traffic and cannot have security profiles attached, because no traffic is forwarded to inspect. Correct
- CA policy with the action set to DENY still forwards the traffic but logs it as suspicious so that an antivirus profile can quarantine the matching files.
- DA policy with the action set to ACCEPT cannot perform any inspection, because security profiles are only configurable on policies whose action is DENY.
- EBoth ACCEPT and DENY policies forward the matching traffic, differing only in whether the FortiGate writes a traffic log entry for the session.
Why A is correct: Correct: only an accept policy forwards traffic, and because the traffic passes through, security profiles can be attached to inspect that permitted flow.
Why B is correct: Correct: a deny policy blocks the matched traffic outright, so there is nothing to scan and the security profile fields are unavailable on a deny policy.
Why C is wrong: This is tempting because deny policies can log, but a deny action drops the traffic rather than forwarding it, and no antivirus profile inspects or quarantines dropped traffic.
Why D is wrong: This inverts the rule; security profiles attach to accept policies precisely because traffic is forwarded and available to scan, whereas a deny policy forwards nothing to inspect.
Why E is wrong: This is wrong because a deny policy does not forward the traffic at all; the actions differ in whether traffic is permitted, not merely in logging behaviour.