In a FortiGate HA cluster (active-active or active-passive), if the primary unit fails, a secondary unit automatically takes over as the primary, ensuring continuity of traffic with minimal disruption. Option A is incorrect as traffic continues, C is incorrect as the mode doesn’t change post-failure, and D is unrelated. Exact extract: "In a FortiGate HA cluster, if the primary unit fails, a secondary unit is elected as the new primary, taking over all roles to maintain traffic flow and session continuity."

IPsec operates at Layer 4 (Transport Layer) in the OSI model, providing secure communication via protocols like ESP and AH, which work with TCP or UDP. BGP and OSPF are Layer 3 (Network Layer) routing protocols, and ARP operates at Layer 2 (Data Link Layer). Fortinet’s FortiGate uses IPsec for VPNs at Layer 4. Exact extract: "IPsec operates at the Transport Layer (Layer 4) to secure communications, encapsulating TCP or UDP packets... BGP and OSPF function at the Network Layer, while ARP resolves IP to MAC addresses at the Data Link Layer."

Typical Layer 2 switches support STP (Spanning Tree Protocol) to prevent loops in redundant networks and VLANs (Virtual Local Area Networks) to segment traffic logically. OSPF is a Layer 3 routing protocol typically on routers, and SIP is for VoIP session initiation, not core switch functions. FortiSwitch supports STP variants like MSTP and VLAN tagging. Exact extract: MSTP supports multiple spanning tree instances, where each instance carries traffic for one or more VLANs (the mapping of VLANs to instances is configurable). These protocols include the Spanning Tree Protocol (STP), Multiple Spanning Tree Protocol (MSTP), and Per-VLAN Rapid Spanning Tree Protocol ( ... FortiSwitch supports Spanning Tree Protocol (STP), Multiple Spanning Tree Protocol (MSTP), and Per-VLAN Rapid Spanning Tree Protocol (RSTP). Spanning Tree Protocol (STP) is a link-management protocol to enable a layer 2 loop-free topology. STP enables a network to have redundant paths for fault ... Go to WiFi & Switch Controller > FortiSwitch Ports. Click a port row. Click the Native VLAN column in one of the selected entries to change the native VLAN.

FortiGate uses SSH (Secure Shell) by default for secure management access, providing encrypted command-line access. Telnet (A) and HTTP (C) are insecure, and SNMP (D) is for monitoring, not management. Exact extract: "FortiGate enables SSH by default for secure management access, providing encrypted CLI access to administrators."

FortiGate’s SSL Inspection feature decrypts and inspects SSL/TLS traffic to detect threats or enforce policies, using techniques like full SSL inspection or certificate inspection. Deep Packet Inspection (A) is a broader term, Application Control (C) identifies apps, and Web Filtering (D) blocks URLs, not specific to SSL. Exact extract: "SSL Inspection allows FortiGate to decrypt and inspect SSL/TLS traffic to detect hidden threats or enforce security policies, supporting full or certificate-based inspection."

Out-of-order packets after FIN/ACK indicate a packet arriving in the TIME_WAIT state, where the session is closing. The TCP time-wait timer controls how long the firewall keeps the session in the TIME_WAIT state to handle late packets. Increasing this timer allows the firewall to accept such packets instead of dropping them. Close-wait timer relates to a different state, TCPMSS affects packet size, and "Enable TCP option" is not a standard parameter. Exact extract: "The TCP time-wait timer determines how long a session remains in the TIME_WAIT state to handle out-of-order or retransmitted packets after FIN/ACK... Adjusting this timer can prevent drops of late-arriving packets."

The TCP MSS (Maximum Segment Size) defines the maximum TCP payload size, excluding headers. When the firewall sets MSS to 1450 bytes, the TCP segment size is limited to this value. For IP packets, the total size includes the TCP header (20 bytes) and IP header (20 bytes), so 1450 (MSS) + 20 (TCP) + 20 (IP) = 1490 bytes, which fits within both link MTUs (1500 and 1496 bytes). Thus, the maximum IP packet size is not limited by the link MTUs but by the MSS, adjusted for headers. Options C and F (bits) are incorrect units; A and B exceed the MSS limit. Exact extract: "The TCP MSS is adjusted to prevent fragmentation... FortiGate can rewrite the MSS in TCP SYN packets to ensure the total IP packet size (including IP and TCP headers) does not exceed the configured value."