FortiGate's Next-Generation Firewall (NGFW) can operate in two modes: profile-based or policy-based. When configured in policy-based NGFW mode, application control and web filtering are integrated directly into the firewall policy itself, rather than being applied as separate security profiles. This mode is designed for simplified configuration and high performance, and it exclusively uses the flow-based inspection engine. Flow-based inspection analyzes traffic as it passes through the FortiGate without buffering, which offers lower latency suitable for high-speed environments.

A. "Full Content inspection" is a general term often used to describe proxy-based inspection, which is not used in policy-based NGFW mode.

B. Proxy-based inspection buffers entire files for analysis before forwarding them. This mode is available in profile-based NGFW, but not in policy-based NGFW.

C. Certificate inspection is a method used for inspecting SSL/TLS traffic and can be used within flow-based mode, but it is not the overall inspection mode itself.

- FortiGate Security 7.0 Study Guide, "NGFW Mode" chapter, page 10: "Policy-based NGFW mode uses flow-based inspection only."

- FortiOS 7.0.0 Administration Guide, "NGFW mode" section: "In policy-based mode, you can add applications and web filtering categories directly to a firewall policy... This mode uses flow-based inspection."