What are two reasons why FortiGate would be unable to complete the zero-touch provisioning process? (Choose two.)

The zero-touch provisioning (ZTP) process can fail for several reasons. One critical prerequisite is that the FortiGate device must be registered in the FortiGate Cloud portal using its unique cloud key (serial number). If this key is not added, the FortiDeploy service cannot identify the device when it calls home, and thus cannot provide the initial configuration, causing the process to fail.

Additionally, while a factory reset initiates the ZTP process on a device, it can lead to a failure scenario if the device was previously managed. The FortiManager or FortiGate Cloud may still have a record of the device. When the reset device attempts to re-provision, it might be treated as an unauthorized or duplicate device, requiring manual administrator intervention to be re-authorized. This prevents the fully automated ZTP process from completing successfully.

B. This describes a successful step in the ZTP process where the device receives its FortiManager information. This is an indicator of ZTP progressing correctly, not failing.

C. This statement is ambiguous and does not align with any official terminology or documented failure state for the FortiGate ZTP process. It is an invalid scenario.

D. Obtaining a configuration from a platform template is a method of successful ZTP completion via FortiGate Cloud. This represents a successful outcome, not a failure.

1. FortiManager Administration Guide 7.2.1, Page 190, "Zero-touch deployment". The guide explicitly lists as a requirement: "The FortiGate Cloud key must be added to the FortiGate Cloud portal." This directly supports option A as a failure reason if not met.

2. FortiManager Administration Guide 7.2.1, Page 183, "Adding devices". The guide details that newly discovered devices appear in the "Unauthorized Devices" list and must be authorized by an administrator. A factory-reset device that was previously managed would reappear as a new, unauthorized device, thus halting the automated ZTP process until manual authorization occurs. This supports the reasoning for option E leading to an incomplete ZTP cycle.

3. FortiGate Cloud 23.1 Administration Guide, Page 100, "Deploying a new FortiGate". The documentation states, "A factory reset device automatically attempts to connect to FortiGate Cloud. If the device is associated with an account, FortiGate Cloud can deploy a configuration to it." This confirms that registration (Option A) is essential for the process to even begin.