The scanning technique on FortiGate that can be enabled only on the CLI (Command Line Interface) is:
A. Machine learning (AI) scan
While most scanning techniques on FortiGate can be configured through the GUI (Graphical User Interface) or CLI, the machine learning (AI) scan is a feature that can only be enabled and configured using the CLI.
The AI scan is an optional feature that must be enabled in the CLI. You can configure the action for the AI scan to enable, monitor, or disable using the CLI command in the antivirus settings.

The correct statements describing the differences between IPsec main mode and IPsec aggressive mode are:
A. The first packet of aggressive mode contains the peer ID, while the first packet of main mode does not.
In aggressive mode, the first packet contains identification information (such as the peer ID), whereas in main mode, the first packet does not contain such details, providing a higher level of security.
D. Six packets are usually exchanged during main mode, while only three packets are exchanged during aggressive mode.
Main mode typically involves the exchange of six packets to establish the IPsec tunnel, whereas aggressive mode streamlines the process with a reduced exchange of three packets.
The other statements (B and C) are not accurate:
B is incorrect because main mode can be used for dialup VPNs, and it is commonly used in such scenarios.
C is incorrect because both aggressive mode and main mode support Extended Authentication (XAuth), and XAuth is not exclusive to aggressive mode.

The correct statement about traffic flow in an active-active High Availability (HA) cluster is:
A. The SYN packet from the client always arrives at the primary device first.
In an active-active HA cluster, the primary device typically handles the initial SYN packet from the client.
The primary device then determines how to distribute the traffic among the cluster members.
The other statements are not accurate:
B is incorrect because the secondary device does not respond to the primary device with a SYN/ACK.
The response is usually handled by the primary device.
C is incorrect because in an active-active HA cluster, each FortiGate device has its own unique virtual MAC addresses for the HA heartbeat interfaces.
D is incorrect because the ACK from the client is generally processed by the same device that received the initial SYN packet, which is typically the primary device.
So, the correct choice is A.

"NTP, FortiGuard updated/queries, SNMP, DNS Filtering, Log settings and other mgmt related services".
B is wrong because PKI stands for Public Key Infrastructure and is associated with VPNS C is wrong because traffic shaping is configured on a 'Traffic Shaping Policy' A is correct because Fortigate will use Fortiguard for these queries D is correct as the management VDOM (very similar to Palo Alto) can use DNS for DNS queries The FortiGate uses DNS, FortiGuard and other servers through the management VDOM Regardless of of question:
Global settings for vdom's are:
Hostname.
HA Settings.
Fortiguard Settings.
System time.
Administrative Accounts.

The local quick mode selector for site B should be configured to match the remote quick mode selector of site
A. In this case, the remote quick mode selector for site A is 192.16.2.0/24. Therefore, the correct answer is: B. 192.16.2.0/24 So, the administrator should configure the local quick mode selector for site B as 192.16.2.0/24 to ensure that the IPsec VPN configuration is consistent between the two sites.