Exam NSE8_811 topic 1 question 28 discussion

Refer to the exhibit.

The exhibit shows a topology where a FortiGate is split into two VDOMs, root and vd-lan. The root VDOM provides external SSL-VPN access, where the users are authenticated by a FortiAuthenticator. The vd-lan VDOM provides internal access to a Web server.
For the remote users to access the internal Web server, there are a few requirements as follows:
"¢ All traffic must come from the SSL-VPN.
"¢ The vd-lan VDOM only allows authenticated traffic to the Web server.
"¢ Users must only authenticate once, using the SSL-VPN portal.
"¢ SSL-VPN uses RADIUS-based authentication.
Given these requirements and the topology shown in the exhibit, which two statements are true? (Choose two.)