The utility has three separate substation uplink interfaces on the FortiGate, and the security team wants to write one set of firewall policies that treats all three as a single named group of interfaces for policy matching, rather than writing three nearly identical policies for each individual interface. Which FortiGate construct is designed for grouping interfaces this way for policy purposes?
Select an answer to reveal the explanation.
Short Explanation
Instead of writing the same policy three times, group the three substation uplinks into a zone and point a single policy at that name. It's a grouping label you use for policy matching, not a way to merge the links themselves.
Full Explanation
A zone is a named grouping of one or more interfaces that firewall policies can reference as a single source or destination, letting administrators write one policy for every interface in the zone instead of duplicating the rule per interface. That's exactly the policy-authoring convenience the security team is after for the three substation uplinks. An aggregate interface would be the wrong tool because it merges physical links into one interface via a link-aggregation protocol toward a single upstream device, which assumes the uplinks terminate together on compatible equipment — not the case here, since these are three distinct connections that should stay individually addressable, just grouped for policy. A software switch similarly merges member interfaces into one internal broadcast domain for local switching, a different goal from labeling several already-distinct interfaces for shared policy treatment. A static route only defines a forwarding path; it has no concept of grouping interfaces for policy matching. To confirm the zone works as intended, create one policy sourced from the zone and verify it matches traffic arriving on any of the three member interfaces.