When a Security Profile is matched with a request, a tag is generated for the Profile itself, and for the Profile that was used. If the names are similar (which is true for default values, as in the example), then the tags can appear to be redundant.