From the exhibits:
System performance output
Memory used: 90%
Free memory: ~5%
Default memory thresholds (FortiOS 7.6)
memory-use-threshold-green 82%
memory-use-threshold-red 88%
memory-use-threshold-extreme 89%
Because memory usage (90%) exceeds the extreme threshold (89%), the FortiGate enters conserve mode.
Effects of conserve mode (FortiOS 7.6 - verified)
B . FortiGate has entered conserve mode.
Correct
When memory usage exceeds the red/extreme threshold, FortiGate automatically enters conserve mode.
This is exactly the condition shown in the system performance output.
D . Administrators can change the configuration.
Correct
Even in conserve mode:
Administrators can still log in (GUI, SSH, console)
Configuration changes are allowed
FortiGate does not lock configuration access during conserve mode.
This behavior is explicitly documented in the FortiOS 7.6 Conserve Mode section.
Why the other options are incorrect
A . Administrators can access FortiGate only through the console port.
Incorrect
Network access (GUI/SSH) is still available in conserve mode unless otherwise restricted.
Console-only access is not a conserve-mode requirement.
C . FortiGate drops new sessions.
Incorrect (as a general statement)
FortiGate may drop or bypass new inspection-required sessions depending on fail-open/fail-close settings.
It does not universally drop all new sessions, so this statement is not always true.

"You can configure the fail-open setting under config ips global to control how the IPS engine behaves when the IPS socket buffer is full."
"If the IPS engine does not have enough memory to build more sessions, the fail-open setting determines whether the FortiGate should drop the sessions or bypass the sessions without inspection."
"It is important to understand that the IPS fail-open setting is not just for conserve mode-it kicks in whenever IPS fails. Most failures are due to a high CPU issue or a high memory (conserve mode) issue." Technical Deep Dive:
The correct answer is A.
The log text says:
logdesc="IPS session scan paused"
action="drop"
msg="IPS session scan, enter fail open mode"
That combination indicates an IPS failure condition, specifically the condition described in the guide where the IPS socket buffer is full and the IPS engine lacks enough memory/resources to build additional sessions. In that state, FortiGate applies the configured IPS fail-open behavior. Since the log shows action="drop", the device is not bypassing those new sessions; it is dropping them.
Why the other choices are wrong:
B is wrong because the guide ties fail-open to socket buffer/resource exhaustion, not packet decode failure.
C is wrong because this is not evidence of a manual diagnostic pause.
D is wrong because the study guide does not associate this log with dirty-flag packet reevaluation.
Operationally, this usually points to high memory, high CPU, or conserve-mode pressure affecting the IPS engine. Useful checks are:
get system performance status
diagnose hardware sysinfo conserve
diagnose sys top
Those help confirm whether the IPS issue is being driven by memory pressure or CPU exhaustion.

"With these multiple filters, which one has the priority? After the IPS engine examines the traffic stream for a signature match, FortiGate scans packets for matches, in this order, for the application control profile:
1. Application and filter overrides..."
"Next, the scan checks for application and filter overrides. Because a filter override is configured to block applications that use excessive bandwidth, it blocks all applications using excessive bandwidth, regardless of other categories that allow these applications."
"In this scenario, the filter override (Excessive-Bandwidth) is blocked and, since Dailymotion falls under the excessive bandwidth category, Dailymotion is blocked even though it is set to Monitor in the Application and Filter Overrides section. The priority in which application and filter overrides are placed takes precedence."
"To allow web filtering, DNS filtering, or application control for HTTPS traffic, you must select an SSL inspection profile with certificate inspection or a deep inspection enabled." Technical Deep Dive:
The problem is not flow-based mode and not the SSL profile. Your firewall policy already has certificate-inspection, and the study guide explicitly says that application control for HTTPS traffic works with certificate inspection or deep inspection. So option B is unnecessary, and option A is unrelated.
The real issue is the override order inside the application sensor:
Priority 1: Filter = Excessive-Bandwidth, Action = Block
Priority 2: Vendor = Google, Action = Monitor
FortiGate evaluates overrides from top to bottom and applies the first match. Many Google applications match the Excessive-Bandwidth filter, so they are blocked before the later Google/Monitor override is ever reached. That is why Google apps fail while www.fortinet.com still works.
So the correct fix is to move the Google override above the Excessive-Bandwidth filter, making Google the first match.
A representative CLI-style logic would be:
config application list
edit "default"
config entries
edit 1
set vendor "Google"
set action monitor
next
edit 2
set filter "Excessive-Bandwidth"
set action block
next
end
next
end
That preserves the bandwidth block for other apps while allowing Google applications to match the higher-priority override first.

In FortiOS 7.6, when FortiGate is integrated with FortiAnalyzer and FortiManager, firewall policies rely on a Universally Unique Identifier (UUID) to ensure proper policy tracking, synchronization, and log correlation across devices.
Why the UUID is required
Every firewall policy in FortiOS has a UUID.
FortiManager uses the UUID to:
Track policies across managed FortiGate devices
Maintain policy consistency during installs and revisions
FortiAnalyzer uses the UUID to:
Correlate logs accurately to the correct firewall policy
Preserve log association even if policy order or policy ID changes
Without a UUID:
Policy-to-log mapping can break
FortiManager cannot reliably manage or synchronize policies
FortiAnalyzer log analysis becomes inconsistent
This is explicitly documented in Fortinet administration and logging architecture references.
Why the other options are incorrect
B). Policy IDPolicy ID can change when policies are moved and is not reliable for long-term correlation across FortiManager and FortiAnalyzer.
C). Sequence IDSequence ID reflects GUI ordering only and has no role in log correlation.
D). Log IDLog ID is generated per log event, not per firewall policy.