Which of the following statements are correct regarding the configuration of a FortiGate unit as an SSL VPN gateway? (Select all that apply.)

Tunnel mode does not require a Host Check option; host checks are optional security measures to verify client posture but are not a prerequisite for tunnel mode functionality.

While routes are needed, they are primarily configured within the SSL VPN settings or assigned to the client through the portal, not solely defined 'in the firewall policies of the VDOM' as the primary mechanism of route distribution for the VPN client.

In FortiGate SSL VPN configuration, users are associated with SSL VPN user groups, and these groups are then assigned specific SSL VPN portals. This structure ensures that users receive the correct access privileges and portal experience.

Each SSL VPN portal is configured to specify the access mode, which can be 'Web Mode' (web-only access to internal web resources) or 'Tunnel Mode' (full network access via a virtual IP), or both. This setting directly controls how the client connects and what resources it can reach.