To configure redundant IPsec VPN tunnels on FortiGate with failover capability, the following two key configuration changes are required:
A . Enable Dead Peer Detection (DPD): Dead Peer Detection is crucial for detecting if the remote peer is unreachable. By enabling DPD, FortiGate can quickly detect a dead tunnel, ensuring a faster failover to the secondary tunnel when the primary tunnel goes down.
C . Configure a lower distance on the static route for the primary tunnel and a higher distance on the static route for the secondary tunnel: The static route with the lower distance (higher priority) will be used when both tunnels are operational. If the primary tunnel fails, the higher distance (lower priority) route for the secondary tunnel will take over, ensuring traffic is routed correctly.
The other options are not suitable:
B . Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels: This option is not directly related to the requirements of failover between two IPsec VPN tunnels.
D . Configure a higher distance on the static route for the primary tunnel and a lower distance on the static route for the secondary tunnel: This would prioritize the secondary tunnel over the primary tunnel, which is opposite to the desired configuration.
Reference
FortiOS 7.4.1 Administration Guide - Configuring IPsec VPN, page 1320.
FortiOS 7.4.1 Administration Guide - Redundant VPN Configuration, page 1335.

The correct actions for static URL filtering in FortiGate are:
A. Block: This action blocks access to the specified URL or category.
D. Exempt: This action exempts the specified URL or category from filtering.
E. Allow: This action allows access to the specified URL or category.
So, the correct choices are A, D, and E.

B. Intrusion prevention system engine.
The Intrusion Prevention System (IPS) engine on FortiGate handles application control traffic, along with other functions such as detecting and preventing network attacks based on predefined signatures and behavioral analysis.
Application control can be configured in proxy-based and flow-based firewall policies. However, because application control uses the IPS engine, which uses flow-based inspection, inspection is always flow- based.
It uses an IPS engine to analyze network traffic and detect application traffic, even if the application is using standard or non-standard protocols and ports.

The Fortinet Single Sign-On (FSSO) Collector Agent supports three primary methods for Active Directory (AD) polling to collect user information:
WinSecLog: Monitors Windows Security Event Logs for login events.
WMI: Uses Windows Management Instrumentation to poll user login sessions.
NetAPI: Utilizes the Netlogon API to query domain controllers for user session data.
These methods allow the FortiGate to gather user logon information and enforce user-based policies effectively.
Reference:
FortiOS 7.4.1 Administration Guide: FSSO Configuration

B: FortiGate allocates port blocks on a first-come, first-served basis
C: For logging purposes, when FortiGate allocates a port block to a host, it generates a system event log to inform the administrator Not A: FortiGate allocates a block size and number per host for a range of external addresses Not D: It allows 8 blocks of 128 ports per host FortiGate allocates port blocks on a first-come, first-served basis.
For logging purposes, when FortiGate allocates a port block to a host, it generates a system event log to inform the administrator.