Which is NOT true about source matching with firewall policies?

A source address object is a common and often essential element for defining the origin of traffic allowed or denied by a firewall policy.

FortiGate supports user-based policies, allowing traffic to be matched and controlled based on authenticated users or user groups.

Device identification and control are features of FortiGate, enabling policies to be applied based on the type of device initiating the connection.

A source interface is a fundamental component of a firewall policy, specifying the ingress interface from which the traffic originates.

Firewall policies allow granular control based on various source criteria, including source IP address, source interface, source user/group, and source device. However, you are not required to specify *both* a source user/group and a source device in the same policy; you can specify one, both, or neither (along with other criteria like source address).