The correct statements regarding FortiGate in transparent mode are:
A. By default, all interfaces are part of the same broadcast domain.
D. FortiGate forwards frames without changing the MAC address.
In transparent mode, FortiGate operates at Layer 2 and doesn't change the MAC addresses of the packets it forwards. Also, all interfaces are part of the same broadcast domain by default. This means that devices connected to different interfaces of the FortiGate can communicate with each other as if they are on the same network segment.

C. ZTNA provides a security posture check.
D. ZTNA provides role-based access.
ZTNA (Zero Trust Network Access) is a security architecture that is designed to provide secure access to network resources for users, devices, and applications. It is based on the principle of "never trust, always verify," which means that all access to network resources is subject to strict verification and authentication.
Two functions of ZTNA are:
ZTNA provides a security posture check: ZTNA checks the security posture of devices and users that are attempting to access network resources. This can include checks on the device's software and hardware configurations, security settings, and the presence of malware.
ZTNA provides role-based access: ZTNA controls access to network resources based on the role of the user or device. Users and devices are granted access to only those resources that are necessary for their role, and all other access is denied. This helps to prevent unauthorized access and minimize the risk of data breaches.
A. ZTNA manages access through the client only. (client or browser)
B. ZTNA manages access for remote users only. (not just remote)
C. ZTNA provides a security posture check.
D. ZTNA provides role-based access.
ZTNA is an access control method that uses client device identification, authentication, and zero-trust tags to provide role-based application access.
IP/MAC filtering uses ZTNA tags to provide an additional factor for identification, and a security posture check to implement role-based zero-trust access.

C. Logs are overwritten, and the first warning is issued when log disk usage reaches the threshold of 75%.
When the log disk usage reaches 75%, a warning is issued, and logs are overwritten to make space for new logs. This allows the device to continue logging events while maintaining a threshold to prevent the disk from filling up completely.
First warning 75%, second 90% and final Warning 95%
Only 75% of the disk is available to store logs, this is distributed in the existing vdoms.
Diagnose sys logdisk usage -- CLI command to verify this.

The scanning technique on FortiGate that can be enabled only on the CLI (Command Line Interface) is:
A. Machine learning (AI) scan
While most scanning techniques on FortiGate can be configured through the GUI (Graphical User Interface) or CLI, the machine learning (AI) scan is a feature that can only be enabled and configured using the CLI.
The AI scan is an optional feature that must be enabled in the CLI. You can configure the action for the AI scan to enable, monitor, or disable using the CLI command in the antivirus settings.

C is correct and tested (user added and user group are added to policy but ip address or network failed to add) We have just confirmed this on a Production Fortigate FW and you can add user/User group but you cannot add Address group with ISDB object. It will simply show a red highlighted error which is read as
"Addresses/groups cannot be mixed with Internet Services"
if src: you can add user, if dst: you cannot add any other object.
You can't mix ISDB objects with regular address objects. User objects are not restricted in any way.