- Browser CAT2 & Local subnet & User B --> deny
- Browser CAT1 & Local subnet & User all --> accept Above exhibits only users from Chrome and IE are allowed.
Chrome and IE use the same system proxy setting. Proxy rule is accept for all users with these two browsers.
C: hit the 3rd rule.

These three statements are indeed true regarding session-based authentication:
A. HTTP sessions are treated as a single user: Session-based authentication can treat multiple HTTP sessions as a single user, providing a consolidated view of user activity.
C. It can differentiate among multiple clients behind the same source IP address: Session-based authentication is capable of distinguishing between multiple clients behind the same source IP address.
D. It requires more resources: Session-based authentication may require more resources compared to simpler authentication methods due to the additional processing involved in tracking and managing user sessions.
For A: Each session-based authenticated user is counted as a single user using their authentication membership (RADIUS, LDAP, FSSO, local database etc.) to match users in other sessions. So one authenticated user in multiple sessions is still one user.

Policy with ID 5.
It's coming from port 3 - hits Facebook-Web (Application) from the screenshot it show that it allows http and https traffic (80, 443).
There are 3 rules related to port3
and two rules source LOCAL_CLIENT
this would leave us with Rule 1 & 5
Rule one Service is = ULL_UDP
Rule five = Internet Services
Destination port we are looking for is 443 (usually this is TCP)
So it had to be PID5
We are looking for a policy that will allow or deny traffic from the source interface Port3 and source IP address 10.1.1.10 (LOCAL_CLIENT) to facebook.com TCP port 443 (HTTPS). There are only two policies that will match this traffic, policy ID 2 and 5. In FortiGate, firewall policies are evaluated from top to bottom. This means that the first policy that matches the traffic is applied, and subsequent policies are not evaluated. Based on the Policy Lookup criteria, Policy ID 5 will be highlighted.

The correct answer is: B. SNAT
SNAT (Source Network Address Translation), also known as MASQUERADE in iptables, translates the source IP address in a packet to another IP address. It is commonly used in scenarios where internal private IP addresses need to be translated to a single public IP address when accessing the Internet, for example. DNAT (Destination Network Address Translation) translates the destination IP address in a packet to another IP address. VIP (Virtual IP) is used to designate a single IP address that represents multiple servers for load balancing or high availability purposes. IPPOOL typically refers to a range of IP addresses that can be dynamically assigned to clients, such as in DHCP.

1. Override is disable by default - OK
2. "If the HA uptime of a device is AT LEAST FIVE MINUTES (300 seconds) MORE than the HA Uptime of the other FortiGate devices, it becomes the primary" The question here is HA Uptime of FGVM01000006492 > 5 minutes? NO - 198 seconds < 300 seconds (5 minutes) HA age of fortinet SNxxx64682 is only 198seconds, HA by age need more than 300 seconds as estated in the reference "If HA age difference is less than 5 minutes (300 seconds), the device priority and FortiGate serial number selects the cluster unit to become the primary unit.
B. FortiGate devices are not in sync because one device is down. (not in exhibit)
C. FortiGate SN FGVM010000064692 is the primary because of higher HA uptime. (no greater than 300 sec)