Refer to the exhibit.

The exhibit shows output of the command diagnose sys adwan aervice4 collected on a FortiGate device.
The administrator wants to know through which interface FortiGate will steer traffic from local users on subnet 10.0.1.0/255.255.255.192 and with a destination of the social media application Facebook.
Based on the exhibits, which two statements are correct? (Choose two.)

1. A. When FortiGate cannot recognize the application of the flow, it steers the traffic through the preferred member of rule 3, HQ_T1.
2. B. There is no service defined for the Facebook application, so FortiGate appliesservice rule 3 and directs the traffic to headquarters.
3. C. FortiGate steers traffic for social media applications according to the service rule 2 and steers traffic through port2.
4. D. When FortiGate cannot recognize the application of the flow, it load balances the traffic through the tunnels HQ_T1. HQ_T2. HQ_T3.

Correct Answer: CD

Exhibit.

Refer to the exhibit, which shows an SD-WAN zone configuration on the FortiGate GUI. What can you conclude about the zone and member configuration on this device?

1. A. The underlay zone contains three members.
2. B. You can delete the virtual-wan-link zones.
3. C. The overlay-factories zone contains no member.
4. D. You can move HUB1-VPN3 from the HUB1 zone to the overlay-shops zone.

Correct Answer: C

Exhibit.

The administrator configured the IPsec tunnel VPN1 on a FortiGate device with the parameters shown in exhibit.
Based on the configuration, which three conclusions can you draw about the characteristics and requirements of the VPN tunnel? (Choose three.)

1. A. The tunnel interface IP address on the spoke side is provided by the hub.
2. B. The remote end can be a third-party IPsec device.
3. C. The administrator must manually assign the tunnel interface IP address on the hub side
4. D. The remote end must support IKEv2.
5. E. This configuration allows user-defined overlay IP addresses.

Correct Answer: BCE

Refer to the exhibit.

An administrator is troubleshooting SD-WAN on FortiGate. A device behind branch1_fgtgenerates traffic to the 10.0.0.0/8 network.
The administrator expects the traffic to match SD-WAN rule ID 1 and be routed over HUB1- VPN1. However, the traffic is routed over HUB1-VPN3.
Based on the output shown in the exhibit, which two reasons, individually or together, could explain the observed behavior? (Choose two.)

1. A. HUB1-VPN3 has a higher member configuration priority than HUB1-VPN1.
2. B. The traffic matches a regular policy route configured with HUB1-VPN3 as the outgoing device
3. C. HUB1-VPN1 does not have a valid route to the destination
4. D. HUB1-VPN3 has a lower route priority value (higher priority) than HUB1-VPN1.

Correct Answer: AD

What are three key routing principles of SD-WAN? (Choose three.)

1. A. Directly connected routes have precedence over SD-WAN rules.
2. B. Policy routes have precedence over SD-WAN rules.
3. C. SD-WAN rules are skipped if the best route to the destination is a static route
4. D. SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.
5. E. SD-WAN members are skipped if they do not have a valid route to the destination.

Correct Answer: BDE