The correct answers are A and D. A Versa stateful firewall primarily enforces security by tracking connection state and matching packet/session information such as source, destination, zones, services, protocol, and L3/L4 attributes. Versa's CLI configuration guide shows stateful firewall access-policy match options for source and destination addresses, services, IP version, IP flags, DSCP, TTL, and also optional application and URL-category match fields when enhanced services are available.

A Versa NGFW extends this inspection model by adding deeper Layer 7 and UTM capabilities, such as IDS/IPS, antivirus, URL filtering, file or data filtering, and application-aware enforcement. Versa's SD-WAN design guide specifically describes internet security using the Versa next-generation firewall with unified threat management features, including IDS/IPS and antivirus inspection for DIA traffic. Licensing is also a valid distinction: Versa's SD-WAN licensing overview describes NGFW features as part of solution tiers, so the availability of advanced security functions depends on the licensed tier or subscription