A firewall policy protecting an outbound path from the back-office segment has both a file filter profile and a DLP profile attached. A file being transferred matches a block rule in the file filter profile. What happens to that specific transfer, at minimum?
Select an answer to reveal the explanation.
Short Explanation
Two independent checkpoints on the same road each get to say stop on their own — one doesn't need the other's permission first. If either one flags the load, the load stops.
Full Explanation
Each security profile attached to a policy evaluates traffic against its own match criteria independently, and any one of them matching its configured action is enough to act on that traffic — there is no requirement that every attached profile agree before enforcement happens. So a file filter block on its own is sufficient to stop the transfer regardless of what the DLP profile separately observed. The wrong option requiring DLP to also match invents a dependency between the two profiles that doesn't exist; they don't need to corroborate each other. The wrong option allowing the transfer through unless DLP also flags it gets the logic backwards, effectively letting a DLP profile override a file filter block, which isn't how independently matching profiles behave. The wrong option claiming DLP always takes precedence invents a fixed hierarchy between profile types that FortiOS doesn't enforce; there's no rule making one profile category dominant over another. A caveat: the order profiles are applied within the inspection pipeline can affect what content a later profile even gets to examine if an earlier one has already acted on the traffic, but the outcome for this specific transfer — blocked — doesn't depend on that ordering detail. To confirm this in practice, review the logs for both profiles after a test file and expect to see the file filter's block entry even if the DLP profile shows no separate match of its own.