✅ Option D (Correct) Reasoning: When configured for passive mode, FortiGate monitors existing user traffic, including TCP, to derive performance metrics like latency and packet loss for the service-level agreement.✅ Option E (Correct) Reasoning: If no traffic is detected on a link for a configurable timeout (often 3 minutes by default), passive monitoring cannot collect data. In such cases, the FortiGate falls back to active monitoring to continuously assess the link’s status.❌ Why the other choices are incorrect:

Option A is incorrect: While FortiGate can passively monitor ICMP traffic, options D and E represent more distinct observable impacts, covering both a specific traffic type and the critical fallback behavior.

Option B is incorrect: Performance SLA monitors all configured SD-WAN member interfaces, not exclusively the preferred link, to assess their performance.

Option C is incorrect: Hardware offloading is a separate FortiGate function that accelerates traffic processing and is independent of whether performance SLA is configured in passive mode.

✅ Option B (Correct) Reasoning: When configuring two distinct static routes, one referencing an SD-WAN another referencing an individual SD-WAN member, their destination subnets must be different. If they share the same destination subnet, they would conflict, and only one route would be active for that specific traffic, based on FortiGate’s routing precedence rules (longest prefix match, administrative distance, metric).
❌ Why the other choices are incorrect:

Option A is incorrect: FortiGate allows creating static routes that reference an SD-WAN zone (e.g., ‘set device sdwan’). This is a common method to direct traffic to the SD-WAN for policy-based routing.

Option C is incorrect: SD-WAN members are typically physical or logical interfaces (e.g., ‘port1’, ‘wan1’). You can certainly create static routes pointing to these individual interfaces, bypassing SD-WAN rules for specific traffic.

Option D is incorrect: The destination subnets of these routes do not inherently need to overlap. They can be entirely separate, allowing the routes to direct different traffic flows independently.

✅ Option A (Correct) Reasoning: A remote breakout design, particularly in a FortiSASE context, routes traffic to the nearest cloud PoP for security inspection. This centralizes security functions in the cloud and allows local devices at the branch or client to have limited security capabilities, offloading the processing to the SASE service.✅ Option C (Correct) Reasoning: A cloud on-ramp topology is designed to provide optimized and secure access to cloud applications. By directing web traffic to cloud security services (like a Cloud SWG), it centralizes inspection and reduces the need for complex security appliances and their associated management at local sites.❌ Why the other choices are incorrect:

Option B is incorrect: Secure Private Access (SPA) is a core component of SASE, focused on enabling secure access for remote users to private applications, often leveraging ZTNA. While part of a comprehensive SASE strategy, it is more accurately described as a user access capability rather than a fundamental ‘common SD-WAN design’ for network topology.

Option D is incorrect: A standalone design refers to deploying a single device without High Availability (HA) redundancy. This is a deployment choice based on redundancy requirements, not a specific SD-WAN architectural design or topology like cloud on-ramp or backhaul.

✅ Option A (Correct) Reasoning: The Proxy Auto-Configuration (PAC) file is essential for proxy-based endpoints to automatically direct their internet traffic to the FortiSASE proxy, ensuring secure internet access without manual browser configuration. It defines the proxy routing logic.✅ Option C (Correct) Reasoning: Installing the FortiSASE Certificate Authority (CA) certificate on proxy-based endpoints is crucial. It allows endpoints to trust the FortiSASE proxy when it performs SSL/TLS inspection, preventing certificate warnings and enabling deep content analysis.❌ Why the other choices are incorrect:

Option B is incorrect: FortiClient software is primarily used for tunnel-based secure internet access (IPsec or SSL VPN) to FortiSASE, not for direct proxy-based access which relies on browser or system proxy settings.

Option D is incorrect: Tunnel policies apply to managing traffic through VPN tunnels for tunnel-based SIA. Proxy-based access configurations do not involve tunnel policies.

✅ Option A (Correct) Reasoning: SD-WAN intelligently routes and optimizes traffic, ensuring reliable and high-performance delivery for a wide array of applications, including those using UDP (like VoIP, video) and TCP (like web, file transfer). This is a direct benefit of integrating SD-WAN.✅ Option D (Correct) Reasoning: FortiSASE provides comprehensive, cloud-delivered inline security inspection (FWaaS, IPS, AV, Web Filtering) for all traffic, including that destined for private applications, ensuring threats are stopped before reaching the internal network. This is a core benefit of FortiSASE Secure Private Access.❌ Why the other choices are incorrect:

Option B is incorrect: While the hub FortiGate performs ZTNA posture checks as the ZTNA gateway, this is a function of the ZTNA architecture itself, not a specific benefit derived from the SD-WAN integration. SD-WAN facilitates the transport to the FortiGate.

Option C is incorrect: In a FortiSASE Secure Private Access deployment, FortiClient traffic is directed to the FortiSASE cloud (PoP) for inline security inspection before being securely tunneled to the on-premises FortiGate. A direct tunnel from FortiClient to the on-premises FortiGate would bypass FortiSASE security services.

✅ Option B (Correct) Reasoning: FortiSASE implements SSO by integrating with external Identity Providers (IdPs) such as Azure AD or SAML-based IdPs. This delegates user authentication to the IdP, allowing users to authenticate once to access multiple FortiSASE security services, thus streamlining the login process.❌ Why the other choices are incorrect:

Option A is incorrect: SSO centralizes identity verification; it does not bypass it. FortiSASE’s zero-trust model requires continuous verification, not bypass for "trusted" networks.

Option C is incorrect: FortiSASE does not store user credentials locally for SSO. It relies on the external IdP to manage and authenticate identities, ensuring a single source of truth.

Option D is incorrect: This contradicts SSO. SSO enables a single authentication for access to multiple services, eliminating the need to authenticate separately for each.

✅ Option D (Correct) Reasoning: FortiSASE’s geofencing feature allows administrators to control remote user connections to FortiSASE Points of Presence (POPs). This control is based on the geographical source country of the user’s connection, enabling policies to permit or deny access from specific regions.❌ Why the other choices are incorrect:

Option A is incorrect: Geofencing primarily addresses location-based access control, not time-of-day restrictions. Time-based policies are usually configured using schedules.

Option B is incorrect: Monitoring and blocking access to personal content falls under Data Loss Prevention (DLP) or content filtering policies, which are distinct from geofencing’s role in controlling connection origin.

Option C is incorrect: Encrypting data at rest on endpoints is an endpoint security function, typically handled by endpoint protection platforms, not a feature of FortiSASE’s network-level geofencing.