FCP-FMG-AD-7-6 sample questions

Question 1

A senior administrator is designing a FortiManager architecture for an enterprise with distinct business units (Sales, Engineering, HR) and a central IT security team. The primary design goals are: 1) Isolate the management of devices and policies for each business unit. 2) Allow the central security team to define and enforce a common set of security profiles (AV, IPS, Web Filter) across all business units.

Accepted Answer

A separate ADOM for each business unit.

Accepted Answer

The Global ADOM.

Answer

Workspace Mode enabled on all ADOMs.

Answer

A dedicated FortiManager cluster for each business unit.

Answer

CLI-based configuration templates.

Question 2

True or False: In a FortiManager HA cluster operating in active-passive mode, the secondary unit actively synchronizes its configuration from the primary unit but does not manage any FortiGate devices directly unless a failover occurs.

Accepted Answer

True

Answer

False

Question 3

A financial services company uses FortiManager 7.6 to manage 50 branch office FortiGates. A junior administrator was tasked with updating the corporate SSL VPN portal banner for all devices. The administrator created a CLI script to upload the new banner text and ran it against the "Branch-Offices" device group. Immediately after, users reported being unable to connect to the SSL VPN.

A senior engineer begins to investigate and observes that the installation log for the script shows "success" for all devices. However, when checking the device settings in FortiManager, the configuration status for all branch FortiGates is "Modified." A `diagnose dvm device list` command on the FortiManager CLI shows the `conf` status as `out-of-sync`. The engineer suspects the script caused an unintended configuration change that is preventing FortiManager from properly managing the devices.

The script used by the junior admin contained the following commands:
```
config vpn ssl web portal
edit "full-access"
set heading "Welcome to Secure Access v2.0"
end
```
The engineer needs to rapidly restore SSL VPN connectivity for all users across all 50 branches with minimal disruption and ensure the configuration is consistent with the FortiManager database.

Accepted Answer

Select the "Branch-Offices" device group, choose "Install Wizard", and perform a "Device Settings (Install Only)" operation to push the last known good configuration from FortiManager to the devices, overwriting the local changes.

Answer

Manually connect to each of the 50 FortiGates and revert the SSL VPN portal heading. Then, re-import the configuration for each device in FortiManager.

Answer

In Device Manager, select all affected FortiGates, right-click, and choose "Refresh Device Status". Then, re-run the script with the correct commands.

Answer

Use the "Script" feature to execute a new script that reverts the change, then select the device group and use "Install Config" to push the empty change set and re-synchronize.

Question 4

An administrator is working in an ADOM where Workspace Mode is enabled. They have locked a policy package to make changes. While the package is locked, another administrator needs to urgently add a new firewall address object that will be used in a different, unlocked policy package.

Accepted Answer

The administrator will be able to create the new address object, as object creation is independent of policy package locks.

Answer

The creation will fail because locking a policy package locks the entire ADOM's object database.

Answer

The administrator will be prompted to request the lock from the first administrator before they can create the object.

Answer

The new object can be created, but it will be in a "pending" state and cannot be used in any policy until the locked package is unlocked.

Question 5

A company is deploying FortiGates to remote sites where the devices are behind a carrier-grade NAT (CGNAT), meaning they have private, non-routable WAN IP addresses. The administrator needs to manage these FortiGates using FortiManager.

Accepted Answer

On the FortiGate, configure the `set central-management` type to `fortimanager` and enable FGFM for device registration. The FortiGate must initiate the connection to the FortiManager.

Answer

Configure a static 1-to-1 NAT on the carrier's NAT device for each FortiGate.

Answer

On the FortiGate, configure the `set fmg-override enable` command to allow it to bypass the NAT.

Answer

On the FortiGate, configure the `set central-management` type to `fortimanager` and enable the `set fmg-source-ip` with the FortiManager's public IP address.

Question 6

An administrator has imported a policy package from a newly managed FortiGate. They notice that several address objects that were used in the imported policies on the FortiGate now have a warning icon in FortiManager and are listed as conflicts in the import wizard.

Accepted Answer

The objects are duplicates of existing objects in the FortiManager ADOM database but have different values.

Answer

The objects are configured with dynamic addresses that FortiManager cannot resolve.

Answer

The objects are associated with interfaces that do not exist in the FortiManager device database for that FortiGate.

Answer

The objects were created by a different administrator on the FortiGate.

Question 7

A system administrator needs to back up the entire FortiManager configuration, including all ADOMs, device configurations, and global settings. They want a single file that can be used to restore the system to a new FortiManager VM in a disaster recovery scenario.

Accepted Answer

From the System Settings > Dashboard, in the System Information widget, select "Backup".

Answer

Go to each ADOM's settings and perform an "Export" for each one.

Answer

From the management pane for a specific device, select "Backup" to save its running configuration.

Answer

Run the `execute backup all-settings` command from the CLI and transfer the file via SCP.

Question 8

An organization is using the Global ADOM to manage a set of corporate security policies. They have a global policy package with a "Header Policy" section that denies traffic to known malicious sites. A junior administrator in a regional ADOM is trying to create a policy to allow access to a specific site for a business partner, but the traffic is still being blocked.

Accepted Answer

Policies created in a local ADOM are processed after the Global ADOM's Header Policies, and the deny rule is being matched first.

Answer

The junior administrator does not have the correct permissions to create policies that override global rules.

Answer

The global policy package needs to be re-installed before any local policy changes are recognized.

Answer

The FortiGate device has not been assigned to the Global ADOM correctly.

Question 9

An administrator is preparing to deploy a standardized configuration to a new group of FortiGate 100F devices using a model device template in FortiManager. The template needs to configure several settings that are unique to each physical device. The diagram below shows the desired variable substitution.

Which TWO of the following methods can be used in FortiManager to correctly populate device-specific values like hostname and management IP during the template deployment? (Select TWO)
```mermaid
graph TD
subgraph FortiManager
T[Model Device Template]
M1[Meta Field: Hostname]
M2[Meta Field: Mgmt_IP]
end
subgraph Deployment
T -- Deploys to --> FGT1[New FGT-100F #1]
T -- Deploys to --> FGT2[New FGT-100F #2]
end
subgraph Result
FGT1 -- Configured with --> C1["hostname: Branch1-FW
mgmt_ip: 10.10.1.1"]
FGT2 -- Configured with --> C2["hostname: Branch2-FW
mgmt_ip: 10.10.2.1"]
end

M1 & M2 -- Used by --> T
```

Accepted Answer

Create custom meta fields for hostname and management IP and assign unique values for each FortiGate device object.

Accepted Answer

Utilize per-device installation variables defined within the Install Wizard.

Answer

Use built-in variables such as `$(hostname)` and `$(ip)` directly in the model device configuration.

Answer

Write a unique TCL script for each device to set these values post-deployment.

Answer

Manually edit the configuration on each FortiGate after the model device template is applied.

Question 10

Global Corp is migrating its firewall management to FortiManager 7.6. They have 200 FortiGates globally, managed by regional teams in AMER, EMEA, and APAC. The CISO has mandated a strict change control process. All policy changes must be reviewed and approved by a senior security architect before being deployed. The regional teams are responsible for creating the change requests, but they must not be able to push changes directly to the FortiGates.

The current FortiManager setup uses three ADOMs: AMER, EMEA, and APAC. The Lead Architect needs to configure the system to enforce the CISO's mandate. The desired workflow is as follows: A regional administrator drafts a policy change, the change is then submitted for approval, the senior architect receives a notification, reviews the diff, and either approves or rejects the change. Only upon approval can the change be installed by a separate deployment team.

The Lead Architect is evaluating the configuration options within the ADOM settings to implement this process. The solution must prevent accidental or unauthorized deployments while providing a clear audit trail of all changes and approvals.

Accepted Answer

Configure "Workspace Mode" with "Workflow" enabled, and define approvers and notification settings.

Answer

Enable "ADOM Revisions" and create a new revision for every change request, using the revision notes for approval tracking.

Answer

Implement a "Normal" mode ADOM and use CLI scripts with a ticketing system integration to manage approvals.

Answer

Set the ADOM mode to "Advanced" and use per-object locking to prevent changes until an email approval is received.

Free FCP-FMG-AD-7-6 sample questions

True or False: In a FortiManager HA cluster operating in active-passive mode, the secondary unit actively synchronizes its configuration from the primary unit but does not manage any FortiGate devices directly unless a failover occurs.

An administrator is working in an ADOM where Workspace Mode is enabled. They have locked a policy package to make changes. While the package is locked, another administrator needs to urgently add a new firewall address object that will be used in a different, unlocked policy package.

A company is deploying FortiGates to remote sites where the devices are behind a carrier-grade NAT (CGNAT), meaning they have private, non-routable WAN IP addresses. The administrator needs to manage these FortiGates using FortiManager.

An administrator has imported a policy package from a newly managed FortiGate. They notice that several address objects that were used in the imported policies on the FortiGate now have a warning icon in FortiManager and are listed as conflicts in the import wizard.

A system administrator needs to back up the entire FortiManager configuration, including all ADOMs, device configurations, and global settings. They want a single file that can be used to restore the system to a new FortiManager VM in a disaster recovery scenario.

10 more free samples are waiting