A FortiGate administrator with the super_admin profile configures a virtual domain (VDOM) for a new customer. After creating the VDOM, the administrator is unable to reassign the dmz interface to the new VDOM as the option is greyed out in the GUI in the management
VDOM.
What would be a possible cause for this problem?

• A. Non-management VDOMs cannot reference physical interfaces
• B. The dmz interface is referenced in the configuration of another VDOM.
• C. The administrator does not have the proper permissions the dmz interface.
• D. The dmz interface is in PPPoE or DHCP mode.

In "diag debug flow" output, you see the message "Allowed by Policy-1: SNAT". Which is true?

• A. The packet matched the firewall policy whose policy ID is 1.
• B. The packet matched the topmost policy in the list of firewall policies.
• C. The packet matched a firewall policy, which allows the packet and skips UTM checks
• D. The policy allowed the packet and applied session NAT.

Regarding tunnel-mode SSL VPN, which three statements are correct? (Choose three.)

• A. It requires the use of an Internet browser.
• B. An SSL VPN IP address is dynamically assigned to the client by the FortiGate unit.
• C. It requires the installation of a VPN client.
• D. It does not support traffic from third-party network applications.
• E. Split tunneling is supported.

The FortiGate port1 is connected to the Internet. The FortiGate port2 is connected to the internal network. Examine the firewall configuration shown in the exhibit; then answer the question below.

Based on the firewall configuration illustrated in the exhibit, which statement is correct?

• A. A user must authenticate using the HTTP, HTTPS, SSH, FTP, or Telnet protocol before they can access all Internet services.
• B. A user that has not authenticated can access the Internet using any protocol that does not trigger an authentication challenge.
• C. DNS Internet access is always allowed, even for users that have not authenticated.
• D. A user that has not authenticated can access the Internet using any protocol except
  HTTP, HTTPS, Telnet, and FTP.

For FortiGate devices equipped with Network Processor (NP) chips, which are true?
(Choose three.)

• A. The kernel does not need to program the NPU. When the NPU sees the traffic, it determines by itself whether it can process the traffic
• B. Sessions for policies that have a security profile enabled can be NP offloaded.
• C. For each new IP session, the first packet always goes to the CPU.
• D. Once offloaded, unless there are errors, the NP forwards all subsequent packets. The
  CPU does not process them.
• E. When the last packet is sent or received, such as a TCP FIN or TCP RST signal, the NP returns this session to the CPU for tear down.