Which two new security capabilities does a next-generation firewall add at the Internet edge? (Choose two.)

Next-generation firewalls (NGFWs) enhance traditional firewall capabilities by adding advanced security features. Integrated intrusion prevention (IPS) allows the firewall to detect and block known threats and attack patterns within network traffic, moving beyond simple port and protocol filtering. Application-level inspection enables the firewall to understand and control traffic based on the specific applications generating it, rather than just ports, providing granular control and threat detection for application-specific vulnerabilities. Stateful packet inspection is a core feature of traditional firewalls, not a new capability added by NGFWs. NAT (Network Address Translation) and VPN (Virtual Private Network) are also established networking services often integrated into firewalls but are not defining new security capabilities of NGFWs themselves.