Which two items must be configured when implementing application override and allowing traffic through the firewall? (Choose two.)

Application filters are used to group applications for use in security policies, but they are not a mandatory configuration element for the act of *implementing* an application override itself.

An application override policy rule is necessary to instruct the firewall to identify specific traffic (based on port and protocol) as a particular application, overriding App-ID's default classification. This forces a specific application interpretation.

Even after an application override rule reclassifies traffic, a corresponding security policy rule is still required to explicitly allow the traffic identified by the overridden application. The security policy acts on the application identity to permit or deny the flow.

While a custom application might be used as the target for an override if a standard application doesn't fit, it's not strictly *required* for every application override scenario; you can override to an existing application.