Refer to the exhibit.

Asymmetric routing is an important consideration in an Azure active-active load balance sandwich because request and response packets can traverse different FortiGate VMs. The study guide identifies NAT as one method to prevent this condition. Enabling NAT on north-south FortiGate policies SNATs packets to the FortiGate internal-interface address, forcing return traffic through the same FortiGate. Where preserving the original source address is required, FGSP can instead synchronize sessions among the FortiGate members and permit asymmetric return traffic. FGCP does not provide the default session-synchronization model for these independent FortiGate VMs in the load balance sandwich. The vdom-exception command is also not the mechanism described for this deployment. Consequently, enabling NAT and supporting synchronized sessions for asymmetric traffic are the two correct characteristics.