The exhibit indicates that the overlay-factories zone currently contains no SD-WAN member. In the GUI, zones containing members can be expanded to display their member interfaces; for example, HUB1 is expanded and shows HUB1-VPN1, HUB1-VPN2, and HUB1-VPN3. The overlay-factories entry does not display any member beneath it. The SD-WAN study material explains that an SD-WAN zone uses one or more interface members and that a zone used for traffic steering must contain at least one member. SD-WAN_7.6_Enterprise_Administr… The exhibit alone does not establish that overlay-factories can safely be deleted because other configuration references can prevent deletion. Likewise, virtual-wan-link is the default SD-WAN zone and cannot simply be treated as a removable user-created zone. Therefore, the directly supported conclusion is that overlay-factories has no member .

================

According to the SD-WAN 7.6 Core Administrator study guide and FortiOS 7.6 Administration Guide, no configuration change is required to simply measure jitter.

Implicit Measurement: In FortiOS, once a Performance SLA (Health Check) is configured with an Active probe mode (as seen in the exhibit with Ping selected), the FortiGate automatically begins calculating three key quality metrics for every member interface: Latency, Jitter, and Packet Loss.

Visibility: Even without an SLA Target defined, these real-time measurements are visible in the SD-WAN Monitor and via the CLI command diagnose sys virtual-wan-link health-check < SLA_Name > .

Active Probes: Because the probe mode is set to Active using the Ping protocol, the FortiGate sends synthetic packets at the defined Check interval (500ms in the exhibit). It calculates jitter by measuring the variation in the round-trip time (RTT) between these consecutive probes.

Why other options are incorrect:

Option B: Adding an SLA target and defining a jitter threshold is only necessary if you want the SD-WAN engine to make steering decisions based on that metric (e.g., " remove this link from the pool if jitter exceeds 50ms " ). It is not required just to measure the jitter.

Option C: While you can specify participants, the current setting is " All SD-WAN Members, " which means it is already measuring jitter for every member.

Option D: HTTP is an alternative probe protocol, but Ping (ICMP) is perfectly capable of measuring jitter and is often preferred for its lower overhead.

According to the FortiSASE 7.6 Administration Guide and the FCP - FortiSASE 24/25 Administrator study materials, the Geofencing feature is a security measure implemented at the edge of the FortiSASE cloud to control ingress connectivity based on the physical location of the user.

Access Control by Location (Option A): Geofencing allows administrators to allow or block remote user connections to the FortiSASE Points of Presence (PoPs) based on the source country, region, or specific network infrastructure (e.g., AWS, Azure, GCP).

Scope of Application: This feature is universal across all SASE connectivity methods. It applies to Agent-based users (FortiClient), Agentless users (SWG/PAC file), and Edge devices (FortiExtender/FortiAP). If a user attempts to connect from a blacklisted country, the connection is dropped at the PoP level before the user can even attempt to authenticate.

Use Case Example: An organization operating exclusively in North America might configure geofencing to block all connections originating from outside the US and Canada. This significantly reduces the attack surface by preventing brute-force or unauthorized access attempts from high-risk regions or countries where the organization has no legitimate employees.

Configuration Path: In the FortiSASE portal, this is managed under Configuration > Geofencing. From there, administrators can create an " Allow " or " Deny " list and select the relevant countries from a standardized global database.

Why other options are incorrect:

Option B: While FortiSASE supports Time-based schedules for firewall policies, geofencing is specifically an IP-to-Geography mapping tool for connection admission, not a time-of-day restriction tool.

Option C: Encryption of data at rest on mobile devices is a function of an MDM (Mobile Device Management) solution or local OS features (like FileVault or BitLocker), not a SASE network geofencing feature.

Option D: Monitoring web behavior and blocking non-work content is the role of the Web Filter and Application Control profiles, which operate on the traffic after the connection is allowed by geofencing.

For customers with hybrid environments (on-premises SD-WAN branches and remote FortiSASE users), the FortiOS 7.6 and FortiSASE curriculum recommends centralized log aggregation for unified visibility.

Centralized Reporting: The standard architectural best practice is to forward logs from FortiSASE to an external FortiAnalyzer (Option C).

Unified View: Since the customer ' s on-premises FortiGate SD-WAN branches are already sending logs to an existing FortiAnalyzer, adding the FortiSASE log stream to that same FortiAnalyzer allows for the creation of combined reports.

Fabric Integration: This setup leverages the Security Fabric, enabling the FortiAnalyzer to provide a single pane of glass for monitoring security events, application usage, and SD-WAN performance metrics across the entire distributed network.

Why other options are incorrect:

Option A: SOCaaS is a managed service for threat monitoring, not a primary tool for an administrator to generate combined SD-WAN/SASE operational reports.

Option B: FortiSASE is not designed to act as a log collector or reporting hub for external on-premises FortiGates.

Option D: Data flows from the source (FortiSASE) to the collector (FortiAnalyzer), not the other way around.

In the SD-WAN 7.6 Core Administrator curriculum, the " Prefer Passive " probe mode is a hybrid monitoring strategy designed to minimize the overhead of synthetic traffic (probes) while maintaining link health visibility. According to the FortiOS 7.6 Administration Guide and the SD-WAN Study Guide, the behavior and impacts are as follows:

TCP Traffic Requirement (Option E): Passive monitoring relies on the FortiGate’s ability to inspect actual user traffic to calculate health metrics such as Latency, Jitter, and Packet Loss. Specifically, it uses TCP traffic (by analyzing TCP sequence numbers and timestamps to calculate Round Trip Time - RTT). If user traffic is flowing through the member interface, the FortiGate uses those real-world sessions for SLA calculations instead of sending its own probes.

Inability to Detect Dead Members (Option C): A significant limitation of passive monitoring is that it cannot distinguish between a " dead " link and an " idle " link. If there is no traffic, the passive monitor has no data to analyze. Consequently, while in passive mode, the SD-WAN engine cannot detect a dead member. To mitigate this, " Prefer Passive " includes a fail-safe: if no traffic is detected for a specific period (typically 3 minutes), the FortiGate will automatically switch to Active mode (sending ICMP/TCP pings) to verify if the link is actually alive.

Why other options are incorrect:

Option A: Passive monitoring generally disables hardware offloading (ASIC) for the monitored traffic. This is because the CPU must inspect every packet header to calculate performance metrics; if the traffic were offloaded to the Network Processor (NP), the CPU would not see the packets, rendering passive monitoring impossible.

Option B: While active probes often use ICMP, passive monitoring is specifically designed for TCP traffic because the TCP protocol ' s ACK structure allows for accurate RTT and loss calculation without synthetic packets.

Option D: The " 3-minute " timer is actually the trigger to switch from passive to active when traffic is absent, not the fallback timer to return to passive. The fallback to passive happens as soon as valid TCP traffic is detected again.

According to the FortiSASE 7.6 Administration Guide and the FCP - FortiSASE 24/25 Administrator study materials, FortiSASE supports three primary external (remote) authentication sources to verify the identity of remote users (SIA and SPA users). These sources allow organizations to leverage their existing identity infrastructure for seamless onboarding and policy enforcement:

Security Assertion Markup Language (SAML) (Option A): This is the most common and recommended method for modern SASE deployments. FortiSASE acts as a SAML Service Provider (SP) and integrates with Identity Providers (IdP) such as Microsoft Entra ID (formerly Azure AD), Okta, or FortiAuthenticator. This enables Single Sign-On (SSO) and Multi-Factor Authentication (MFA).

Lightweight Directory Access Protocol (LDAP) (Option C): FortiSASE can connect to on-premises or cloud-based LDAP servers (such as Windows Active Directory). This allows the administrator to map existing AD groups to FortiSASE user groups for granular security policy application.

Remote Authentication Dial-in User Service (RADIUS) (Option E): RADIUS is supported for organizations that use centralized authentication servers or traditional MFA solutions (like RSA SecurID). FortiSASE can query a RADIUS server to validate user credentials before granting access to the SASE tunnel.

Why other options are incorrect:

OpenID Connect (OIDC) (Option B): While OIDC is a modern authentication protocol similar to SAML, FortiSASE ' s primary integration for external Identity Providers is currently standardized on SAML 2.0.

TACACS+ (Option D): Terminal Access Controller Access-Control System Plus is primarily used for administrative access (AAA) to network devices (like logging into a FortiGate CLI or FortiManager). It is not used for end-user VPN or SASE authentication in the Fortinet ecosystem.