To block access specifically to download.com while allowing other sites in the "Freeware and Software Downloads" category, you can create a separate firewall policy with a deny action specifically for the FQDN *.download.com. This approach allows blocking this particular site without affecting the other sites in the same category. Alternatively, configuring a static URL filter entry with the type set to Wildcard and action set to Block will also achieve the desired effect by directly blocking the specific URL without impacting other sites in the category.
Reference:
FortiOS 7.4.1 Administration Guide: URL filter configuration

C: NTP
D: DNS
Not all the configuration settings are synchronized.
There are a few that are not, such as:
* System interface settings of the HA reserved management interface and the HA default route for the reserved management interface
* In-band HA management interface
* HA override
* HA device priority
* Virtual cluster priority
* FortiGate hostname
* HA priority setting for a ping server (or dead gateway detection) configuration
* All licenses except FortiToken licenses (serial numbers)
* Cache
Fortigate Hostname is not synchronized between cluster member.

Apple facetime will be blocked according to the "Excessive Bandwidth" filter.
Facetime belongs to VoIP category which is monitored here and therefore should be allowed, however, because of the behavior of the facetime "Excessive-Bandwidth", the custom filter Excessive-Bandwidth will block Facetime and the lookup won't continue to the second filter.
The excessive bandwidth filter contains facetime and is referenced by the application sensor with the action to block. There is no reference to a bandwidth threshold at which point the filter is applied so the number of calls is irrelevant.

Session is the name of a mode. Spillover is not the real name for SD-WAN that is in ECMP. Spillover is called Usage in SD-WAN.
The correct load balancing method that uses interface weight values to distribute traffic is:
C. Volume
D. Session
Both Volume-based and Session-based load balancing methods in SD-WAN can use interface weight values to distribute traffic proportionally based on the weights assigned to each interface.
The FortiGate uses the weight that you assign to each interface to calculate a percentage of the total sessions that are allowed to connect through each interface.
The FortiGate uses the volume weight that you assign to each interface to calculate a percentage of the total bandwidth that's allowed to go through each interface.

A. Inter-VDOM links are required to allow traffic between the Local and Root VDOMs.
Incorrect:
B. A default static route is not required on the To_Internet VDOM to allow LAN users to access the internet.
C. Inter-VDOM links are required to allow traffic between the Local and DMZ VDOMs. (transparent- transparent)
D. Inter-VDOM links are not required between the Root and To_Internet VDOMs because the Root VDOM is used only as a management VDOM.
Each VDOM has independent security policies and routing tables. Also, and by default, traffic from one VDOM cannot go to a different VDOM.
You cannot create an inter-VDOM link between Layer 2 transparent mode VDOMs. At least one of the VDOMs must be operating in NAT mode.
Similar to FortiGate without VDOMs enabled, the management VDOM should have outgoing internet access. Otherwise, features such as scheduled FortiGuard updates, fail.