A utility security team is documenting the roles of IPS, file filter, and DLP profiles for their FortiGate deployment. Which statement correctly distinguishes the three from each other?

IPS, file filter, and DLP each address a distinct kind of risk using their own match logic: IPS looks for known attack or exploit patterns in traffic, file filter identifies files by their actual type or name pattern, and DLP looks for sensitive data patterns or transfer characteristics like unusual size. Documenting them this way reflects that they can — and often should — be layered together on the same policy for defense in depth, exactly as seen when a policy carries both file filter and DLP simultaneously. Claiming all three inspect the same criteria and differ only in logging destination ignores that their underlying match engines look at fundamentally different things — attack signatures, file content, and data patterns are not interchangeable inputs. Claiming file filter and DLP are the same feature under different names overlooks that file filter matches on file type or name while DLP matches on content patterns or transfer characteristics, distinct detection logic even where their goals sometimes overlap; and IPS is very much a content-inspection profile, not something outside that category. Claiming the three can only run one at a time on a policy contradicts how a single policy can carry multiple attached profiles simultaneously, each independently evaluating the traffic. A caveat: overlapping coverage between these profiles is intentional layered defense, not redundancy to be trimmed away. To see this distinction directly, review a policy carrying all three and confirm each one logs its own independent entries when tested with traffic relevant to its specific detection type.