B. FortiGate will use the port1 route as the primary candidate.
FortiGate will use the port1 route as the primary candidate. It has better priority.

The type of logs on FortiGate that record information about traffic directly to and from the FortiGate management IP addresses is: A. Local traffic logs
A). Local traffic logs: These logs record information about traffic that is processed by the FortiGate unit itself, including traffic directed to and from the FortiGate management IP addresses.
The other options are not specifically focused on the management IP addresses:
B). Forward traffic logs: These logs generally pertain to traffic that is forwarded through the FortiGate unit.
C). System event logs: These logs capture system-level events, but they may not specifically address traffic to and from management IP addresses.
D). Security logs: While security logs can provide information about security-related events, they may not be specific to the management IP addresses.

C: NTP
D: DNS
Not all the configuration settings are synchronized.
There are a few that are not, such as:
* System interface settings of the HA reserved management interface and the HA default route for the reserved management interface
* In-band HA management interface
* HA override
* HA device priority
* Virtual cluster priority
* FortiGate hostname
* HA priority setting for a ping server (or dead gateway detection) configuration
* All licenses except FortiToken licenses (serial numbers)
* Cache
Fortigate Hostname is not synchronized between cluster member.

The debug trace output shows that the packet was "Denied by forward policy check (policy 0)." In FortiGate, policy ID 0 corresponds to the default implicit deny policy. This means that if a packet does not match any configured firewall policies, it is denied by the default implicit policy.
References:
* FortiOS 7.4.1 Administration Guide: Firewall Policies

Needs SSL full inspection.
They can play video (tick) content hosted on Facebook, but they are unable to leave reactions on videos or other types of posts.
This indicate that the rule are partially working as they can watch video but can't react, i.e. liking the content. So, must be an issue with the SSL inspection rather then adding an app rule.
The lock logo behind Facebook_like.Button indicates that SSL Deep Inspection is Required. All other Application Signatures Facebook and Facebook_Video.Play does not require SSL inspection. Hence that the users can play video content. If you look up the Application Signature for Facebook_like.Button it will say "Requires SSL Deep Inspection".
FortiGate needs to perform full SSL inspection. Without full SSL inspection, FortiGate cannot inspect encrypted traffic.