In the current configuration, although "twitter.com" is allowed in the Static URL Filter, the category "Social Networking" is set to "Block" under the FortiGuard Category Based Filter. To resolve the issue, setting the action to "Exempt" in the Static URL Filter for "twitter.com" will bypass the category-based block for this specific URL while still enforcing the block on other social networking sites.

To retrieve AD user group information in agentless polling mode, the administrator must add an LDAP server to the FortiGate device.

* Enable NAT on the Allow_access firewall policy (A):
* The Allow_access firewall policy must have NAT enabled to allow the webserver to use its VIP external IP address (10.200.1.10) as the source NAT when initiating traffic, such as pings, to the remote server.
* Disable port forwarding on the VIP object (D):
* Port forwarding is designed for specific port mapping, typically for services like HTTP or HTTPS. To use the VIP external IP as a source NAT, port forwarding should be disabled.
Disabling port forwarding ensures that the full VIP IP address is used without being tied to specific ports.
Why other options are not correct:
* B. Create a new firewall policy before Internet_Access for the webserver and apply the IP pool:
* This is unnecessary as the VIP object itself is used for SNAT in this case, and an additional firewall policy is not required.
* C. Disable NAT on the Internet_Access firewall policy:
* Disabling NAT on this policy would prevent the NAT functionality needed for the webserver to use the VIP external IP address as the source IP.
Thus, enabling NAT on the Allow_access policy and disabling port forwarding on the VIP configuration are the valid steps to achieve the goal.

The routing table in the exhibit shows two default routes (0.0.0.0/0) with different administrative distances:
* The default route through port2 has an administrative distance of 20.
* The default route through port1 has an administrative distance of 10.
Administrative distance determines the priority of the route; a lower value is preferred. Here, the route through port1 with an administrative distance of 10 is the preferred route. The route through port2 with an administrative distance of 20 acts as a standby or backup route. If the primary route (port1) fails or is unavailable, traffic will then be routed through port2.
Regarding the statement that the port2 interface is marked as inactive, there is no indication in the routing table that port2 is inactive. Similarly, all the routes displayed are not necessarily installed in the FortiGate routing table, as the table could include both active and backup routes.
References:
* FortiOS 7.4.1 Administration Guide: Default route configuration
* FortiOS 7.4.1 Administration Guide: Routing table explanation