Which two features are found in Palo Alto Networks NGFW but are absent in a legacy firewall product? (Choose two.)

A. Policy match is based on application

B. Traffic control is based on IP, port, and protocol

C. Traffic is separated by zones

D. Identification of application is possible on any port