B). SLA targets are optional.
D). SLA targets are used only when referenced by an SD-WAN rule.
Incorrect:
A). You can configure only two SLA targets per one Performance SLA. (more is possible)
C). SLA targets are required for SD-WAN rules with a Best Quality strategy. (not required) If the health check is used in an SD-WAN rule that uses Manual or Best Quality strategies, enabling SLA Target is optional. If the health check is used in an SD-WAN rule that uses Lowest Cost (SLA) or Maximum Bandwidth (SLA) strategies, then SLA Target is enabled.
Enable SLA Targetsand configure the constraints. To add multiple SLA targets, use the CLI.

The types of traffic and attacks that can be blocked by a Web Application Firewall (WAF) profile include:
C. Server information disclosure attacks: A WAF can help block attacks attempting to disclose sensitive information about the server.
D. Credit card data leaks: A WAF can be configured to detect and block attempts to leak credit card or other sensitive data.
E. SQL injection attacks: WAFs are effective in blocking SQL injection attacks, where attackers attempt to manipulate a web application's database by injecting malicious SQL code. Options A and B are not typically associated with the primary functions of a WAF:
A. Traffic to botnet servers: This is often more related to network security or threat intelligence solutions rather than the primary function of a WAF.
B. Traffic to inappropriate websites: Blocking traffic to inappropriate websites is generally handled by content filtering or URL filtering solutions rather than a WAF.

The routing table in the exhibit shows two default routes (0.0.0.0/0) with different administrative distances:
* The default route through port2 has an administrative distance of 20.
* The default route through port1 has an administrative distance of 10.
Administrative distance determines the priority of the route; a lower value is preferred. Here, the route through port1 with an administrative distance of 10 is the preferred route. The route through port2 with an administrative distance of 20 acts as a standby or backup route. If the primary route (port1) fails or is unavailable, traffic will then be routed through port2.
Regarding the statement that the port2 interface is marked as inactive, there is no indication in the routing table that port2 is inactive. Similarly, all the routes displayed are not necessarily installed in the FortiGate routing table, as the table could include both active and backup routes.
References:
* FortiOS 7.4.1 Administration Guide: Default route configuration
* FortiOS 7.4.1 Administration Guide: Routing table explanation

execute ping
This command helps test network connectivity by sending ICMP echo requests to a specified IP address to check if the device is reachable.
execute traceroute
This command traces the route packets take to a destination, which is useful for identifying network hops and potential delays or routing issues.
get system arp
This command shows the ARP (Address Resolution Protocol) table, which is used to map IP addresses to MAC addresses. It's useful for verifying IP-to-MAC address resolution on the network.

When FortiGate performs SSL/SSH full inspection and detects an invalid certificate, there are three valid actions it can take:
* Allow & Warning: This action allows the session but generates a warning.
* Block & Warning: This action blocks the session and generates a warning.
* Block: This action blocks the session without generating a warning.
Actions such as "Trust & Allow" or just "Allow" without additional configurations are not applicable in the context of handling invalid certificates.
References:
* FortiOS 7.4.1 Administration Guide: Configuring SSL/SSH inspection profile