Which downstream FortiGate VDOM is used to join the Security Fabric when split-task VDOM is enabled on all FortiGate devices?

When split-task VDOM mode is enabled on a FortiGate, the root VDOM is designated to handle all management functions. This includes administrative access, communication with FortiManager and FortiAnalyzer, and establishing connections to the Security Fabric. Traffic-processing VDOMs are isolated from these management tasks. Therefore, the root VDOM of a downstream FortiGate is the one that must be configured to join the upstream FortiGate's Security Fabric.

B. FG-traffic is a common name for a traffic-processing VDOM, which, by design in split-task mode, does not handle management functions like Security Fabric connections.
C. A Customer VDOM is a generic term for a traffic VDOM and would not be responsible for management plane tasks.
D. Global VDOM is not a VDOM that can join the fabric; it refers to the global configuration scope that applies to all VDOMs.

1. FortiOS 7.0.1 Administration Guide, "System > VDOM" chapter, section "Split-task VDOM mode". It specifies, "In split VDOM mode, one VDOM is the management VDOM and the other VDOMs are traffic VDOMs... The management VDOM is used for all management traffic, such as connecting to FortiManager..."

2. Fortinet Security Fabric for FortiOS 7.0 Study Guide, "Security Fabric with VDOMs" section. It clarifies that the management VDOM (typically root) is used for fabric connectivity.