Which two features are found in a Palo Alto Networks NGFW but are absent in a legacy firewall product? (Choose two.)

Which two features are found in a Palo Alto Networks NGFW but are absent in a legacy firewall product? (Choose two.)
A . Traffic is separated by zones
B . Policy match is based on application
C . Identification of application is possible on any port
D . Traffic control is based on IP port, and protocol

Answer: B,C