Refer to the exhibit.
Which statement correctly describes the role of the ADVPN device in handling traffic?

Exhibit - ADVPN IKE debug output

• A. This device is a spoke that has received a shortcut query from a remote hub.
• B. This device is a hub, and two spokes, 192.2.0.1 and 10.0.3.101, established a shortcut.
• C. This device is a hub that has received a shortcut query from a spoke and has forwarded it to another spoke.
• D. This device is a spoke that has received a direct shortcut query from a remote spoke.

When you deploy SD-WAN, you can choose from several common designs. Each design best applies to specific contexts. Which two statements correctly associate a common SD-WAN design with its main indication or constraint? Choose two answers.

• A. Use a cloud on-ramp topology to improve the performance of cloud applications.
• B. Use remote breakout to centralize traffic inspection and limit local management requirements.
• C. Use a standalone design for sites with only one WAN link to the cloud.
• D. Use a direct internet access (DIA) design to increase the traffic security and allow local devices with limited capabilities.

As an MSSP administrator, you are asked to configure ADVPN on an existing SD-WAN topology.
FortiManager manages the customer devices in a dedicated ADOM. The previous administrator used the SD- WAN overlay topology. Which two statements apply to this scenario? (Choose two.)

• A. When auto-discovery VPN is enabled, FortiManager updates the IPsec and BGP templates in the hub.
• B. You can activate auto-discovery VPN in the SD-WAN overlay template only if it is a single hub topology.
• C. You can activate auto-discovery VPN in the SD-WAN overlay template for any type of topology, including a primary-primary dual-hub topology.
• D. After you enable auto-discovery VPN in the overlay template, you must select between ADVPN 2.0 and ADVPN 1.0.

Refer to the exhibits. The administrator configured a device blueprint and CLI scripts as shown in the exhibits, to prepare for onboarding FortiGate devices in the company's stores. Later, a technician prepares a FortiGate 51G with a basic configuration and connects it to the network. The basic configuration contains the port1 configuration and the minimal configuration required to allow the device to connect to FortiManager.
After the device first connects to FortiManager, FortiManager updates the device configuration. Based on the exhibits, which actions does FortiManager perform?

Exhibit 1

Exhibit 2

• A. FortiManager updates the device configuration according to the selected templates. It applies the corp_st template first.
• B. FortiManager updates the configuration of port1, port2, and port5. The three ports might get new IP addresses.
• C. FortiManager does not update the port1 configuration because FortiManager does not change the configuration of interfaces with fgfm access.
• D. FortiManager updates access rights only for port1. FortiManager cannot update the IP address because it was already set manually.

An administrator is enforcing endpoint network lockdown using FortiSASE to ensure that devices access the internet only under defined security conditions. The lockdown state must be released automatically when the endpoint meets specific trust or connectivity criteria.
Which two conditions can trigger the release of the network lockdown on an endpoint? (Choose two answers.)

• A. The endpoint is evaluated as compliant using security posture tags.
• B. The endpoint is rebooted.
• C. The endpoint is detected as being on-net.
• D. The endpoint establishes a connection to the FortiSASE tunnel.