Refer to the exhibit. The administrator analyzed the traffic between a branch FortiGate and the server located in the data center, and noticed the behavior shown in the diagram. When the LAN clients located behind FGT1 establish a session to a server behind DC-1, the administrator observes that, on DC-1, the reply traffic is routed over T2. even though T1 is the preferred member in the matching SD-WAN rule.
What can the administrator do to instruct DC-1 to route the reply traffic through the member with the best performance?

• A. Enable snat-route-change under config system global.
• B. Enable reply-session under config system sdwan.
• C. Enable auxiliary-session under config system settings.
• D. FortiGate route lookup for reply traffic only considers routes over the original ingress interface.

Refer to the exhibit, which shows an SD-WAN zone configuration on the FortiGate GUI. What can you conclude about the zone and member configuration on this device?

• A. You can delete the virtual-wan-link zones.
• B. You can move HUB1-VPN3 from the HUB1 zone to the overlay-shops zone.
• C. The overlay-factories zone contains no member.
• D. The underlay zone contains three members.

Refer to the exhibit. The exhibit shows output of the command diagnose sys sdwan service4collected on a FortiGate device The administrator wants to know through which interface FortiGate will steer traffic from local users on subnet 10 0.1.0/255.255.255.192 and with a destination of the social media application Facebook.
Based on the exhibits, which two statements are correct? (Choose two.)

• A. When FortiGate cannot recognize the application of the flow, it load balances the traffic through the tunnels HQ_T1, HQ_T2, HQ_T3.
• B. FortiGate steers traffic for social media applications according to the service rule 2 and steers traffic through port2.
• C. There is no service defined for the Facebook application, so FortiGate appliesservice rule 3 and directs the traffic to headquarters.
• D. When FortiGate cannot recognize the application of the flow, it steers the traffic through the preferred member of rule 3, HQ_T1.

Refer to the exhibits.



You are using FortiManager to manage the branch devices and configure the SD-WAN template.
You update the configuration to address new user requirements and set the firewall policies shown in the second exhibit.
Then, when you use the install wizard to install the updated configuration and firewall policy package on the branch devices, FortiManager reports the error shown in the third exhibit.
Why can't FortiManager install the configuration on the branch devices?

• A. You cannot install firewall policies for HTTPS traffic with no SSL inspection.
• B. You cannot install firewall policies that reference an SD-WAN member.
• C. You must direct traffic with the default security profile to a VPN tunnel.
• D. You cannot install firewall policies that reference an SD-WAN zone.

Refer to the exhibit. The administrator used the SD-WAN overlay template to prepare an IPsec tunnels configuration for a hub-and-spoke SD-WAN topology. The exhibit shows the FortiManager installation preview for one FortiGate device.
Based on the exhibit, which statement best describes the configuration applied to the FortiGate device?

• A. It is a spoke device that establishes dynamic IPsec tunnels to the hub It can send ADVPN shortcut requests.
• B. It is a hub device. It will automatically discover the spoke devices and add them to the SD-WAN topology.
• C. It is a spoke device that establishes dynamic IPsec tunnels to the hub. The local subnet range is
  10.10.128.0/23.
• D. It is a hub device. It can send ADVPN shortcut offers.