In FortiManager, pre-run CLI templates are used in Zero-Touch Provisioning (ZTP) and Low-Touch Provisioning (LTP) to configure a FortiGate device before it is fully managed by FortiManager.
These templates apply configurations when a device is initially provisioned. Once the pre-run CLI template is executed, FortiManager automatically unassigns it from the device because it is not meant to persist like other policy configurations. This prevents conflicts and ensures that the FortiGate configuration is not repeatedly applied after the initial setup.

" Zero phase 2 selectors " (also known as 0.0.0.0/0 selectors) are commonly used in dynamic VPN environments like ADVPN to allow any traffic to be routed into the tunnel. However, because the selector itself does not define the network range, there is a risk of traffic being sent down " invalid paths " if the routing table is not properly maintained.
* Assign tunnel IP: For dynamic routing protocols to function over an IPsec tunnel, the tunnel interfaces must have IP addresses assigned.
* Routing protocols: To ensure traffic only follows valid paths, dynamic routing protocols (such as BGP or OSPF) must be used to populate the routing table with the specific prefixes that are actually reachable through each tunnel.

Based on the packet capture provided in the exhibit and Fortinet ' s Enterprise Firewall 7.6 inspection standards:
* Web Filtering Effectiveness (B): The exhibit shows the Server Name Indication (SNI) extension within the Client Hello, specifically indicating the hostname www.fortinet.com. When a firewall policy is configured for SSL Certificate Inspection , the FortiGate does not decrypt the payload but instead relies on the SNI or the certificate ' s Subject/SAN fields to identify the website. Therefore, a web filtering profile can effectively categorize and block/allow this traffic based on the domain name found in the SNI.
* TLS Version Support (D): The supported_versions extension is a feature introduced with TLS 1.3 to negotiate the version of the handshake. In the exhibit, the extension explicitly lists two versions: TLS
1.3 (0x0304) and TLS 1.2 (0x0303) . This tells the FortiGate exactly which protocols the client is capable of using for this session.
* Why A is incorrect: Antivirus profiles require Deep SSL Inspection (full decryption) to scan the actual files and payload of the session. Since the policy is using Certificate Inspection , the FortiGate cannot see the cleartext data, rendering the antivirus profile ineffective for this encrypted traffic.
* Why C is incorrect: While the Subject Alternative Name (SAN) is a common way to identify a site, it is found in the server ' s certificate. In this specific capture, the SNI (Server Name Indication) is already present in the Client Hello, which allows the FortiGate to apply security profiles even before the server ' s certificate is seen.

ADVPN (Auto-Discovery VPN) 2.0 is the optimal solution for enabling direct spoke-to-spoke communication without passing through the hub, while also allowing automatic link selection based on quality metrics.
# Dynamic Direct Tunnels:
# ADVPN 2.0 allows spokes to establish direct IPsec tunnels dynamically based on traffic patterns, reducing latency and improving performance.
# Unlike static VPNs, spokes do not need to pre-configure tunnels for each other.
# Automatic Link Optimization:
# ADVPN 2.0 monitors the quality of multiple internet connections on each spoke.
# It automatically switches to the best available connection when the primary link degrades or fails.
# This is achieved by dynamically adjusting BGP-based routing or leveraging SD-WAN integration.

In modern TLS handshakes (starting with TLS 1.3), the Client Hello packet includes a specific extension called supported_versions. This extension lists all the TLS versions the client is capable of using. Typically, a client supporting TLS 1.3 will also list TLS 1.2 for backward compatibility to ensure it can successfully negotiate a secure connection with servers that have not yet upgraded. When both versions are present in the supported_versions field, it signifies that the client is capable of both TLS 1.2 and TLS 1.3 . This is a critical component for FortiGate when performing deep SSL/TLS inspection, as the firewall must understand the negotiated version to decrypt the traffic for security analysis.