The Reverse Path Forwarding (RPF) check is run on the first sent packet of any new session to ensure that the packet arrives on a legitimate interface. This check protects the network from IP spoofing attacks by verifying that a return route exists from the receiving interface back to the source IP address. If the route is invalid or not found, the packet is discarded. Options B and C are incorrect because RPF checks are performed on the first sent packet, not the reply packet.
References:
* FortiOS 7.4.1 Administration Guide: Reverse Path Forwarding (RPF) Check

C. A temporary trusted FortiGate certificate replaces the server certificate when the server certificate is trusted.
D. A temporary untrusted FortiGate certificate replaces the server certificate when the server certificate is untrusted.
In a full (deep) SSL configuration, a temporary untrusted FortiGate certificate replaces the server certificate when the server certificate is untrusted, and a temporary trusted FortiGate certificate replaces the server certificate when the server certificate is trusted.
The behavior that results from this full (deep) SSL configuration is that a temporary untrusted FortiGate certificate replaces the server certificate when the server certificate is untrusted. Additionally, a temporary trusted FortiGate certificate replaces the server certificate when the server certificate is trusted.

The two protocols used to enable administrator access to a FortiGate device are:
A: SSH (Secure Shell)
SSH is a secure protocol used for accessing the command-line interface (CLI) of FortiGate devices.
B: HTTPS (Hypertext Transfer Protocol Secure)
HTTPS is a secure protocol used for accessing the web-based graphical user interface (GUI) of FortiGate devices.

These three statements are indeed true regarding session-based authentication:
A. HTTP sessions are treated as a single user: Session-based authentication can treat multiple HTTP sessions as a single user, providing a consolidated view of user activity.
C. It can differentiate among multiple clients behind the same source IP address: Session-based authentication is capable of distinguishing between multiple clients behind the same source IP address.
D. It requires more resources: Session-based authentication may require more resources compared to simpler authentication methods due to the additional processing involved in tracking and managing user sessions.
For A: Each session-based authenticated user is counted as a single user using their authentication membership (RADIUS, LDAP, FSSO, local database etc.) to match users in other sessions. So one authenticated user in multiple sessions is still one user.

The "d-wan" zone in FortiGate SD-WAN configuration is the default SD-WAN zone created when SD-WAN is enabled. This zone contains all the interfaces assigned to SD-WAN and is essential for the functionality of the SD-WAN feature. The "d-wan" zone cannot be deleted because it is required for SD-WAN operations.
Option A is incorrect because the underlay zone does not contain port1. Options B and D are incorrect because they incorrectly describe the configuration of zones.
References:
* FortiOS 7.4.1 Administration Guide: SD-WAN Zone Configuration