Which two actions can a zone-based firewall apply to a packet as it transits a zone pair? (Choose two.)