Enhance your career with FCP_FMG_AD-7.6 PDF Dumps - True Fortinet Exam Questions
New (2026) Download free FCP_FMG_AD-7.6 PDF for Fortinet Practice Tests
Fortinet FCP_FMG_AD-7.6 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 7 |
|
NEW QUESTION # 18
Refer to the exhibits.
An administrator needed to recover all the configurations related to the user, Support. The configurations were saved in configuration revision ID 9.
The administrator reverted the configuration using theConfiguration Revision Historywindow and received the CLI output shown in the exhibit.
What can you conclude from the CLI output?
- A. The administrator set the flag to 0 to prevent configuration overrides.
- B. The administrator reinstalled the policy package.
- C. The administrator needs to retrieve the device to correctly detect the FortiGate firmware version.
- D. The administrator installed only the device-level configuration.
Answer: C
Explanation:
The CLI output shows the status "dev-db: not modified; conf: in sync; cond: OK; dm: installed," but the firmware version for the device is listed as "[unknown]." This indicates that FortiManager has not properly detected the FortiGate firmware version, likely because the device needs to be retrieved to update its information.
NEW QUESTION # 19
Refer to the exhibit.
What are two results from the configuration shown in the exhibit? (Choose two.)
- A. The administrator must have access to the ADOM to approve changes.
- B. Ungraceful closed sessions will keep the ADOM in a locked state until the administrator session times out.
- C. The administrator can lock policy blocks and FortiManager global ADOM.
- D. The same administrator can lock more than one ADOM at the same time.
Answer: B,C
Explanation:
In normal workspace mode, ungraceful session closures will keep the ADOM locked until the session times out, preventing other administrators from editing.
Normal workspace mode allows administrators to lock policy blocks and the global ADOM, providing granular locking control.
NEW QUESTION # 20
Refer to the exhibits. An administrator runs the reload failure command diagnose test deploymanager reloadconf 262 on FortiManager.
Why does the administrator receive an error message?
- A. The administrator must use the FortiGate name instead of the ID number.
- B. FortiManager does not support FortiOS version 7.0.
- C. The administrator just recently added FortiGate HQ-NGFW as a model device.
- D. FortiManager requires the FortiGate serial number instead of the ID number.
Answer: C
Explanation:
The error occurs because the FortiGate HQ-NGFW device with ID 262 is a newly added model device and has not yet been fully synchronized or installed with a configuration package, which causes the reload configuration command to fail.
NEW QUESTION # 21
Refer to the exhibit. How will FortiManager try to get updates tor antivirus and IPS?
- A. From the default server fds1.fortinet.com
- B. From public FDNI server IP address with the fourth highest octet only
- C. From the configured override server IP address 10.0.1.50 only
- D. From the list of configured override servers or public FDN servers
Answer: C
Explanation:
As the server override mode is strict, there is no fallback. FMG will communicate only with server configure in override server list.
NEW QUESTION # 22
Refer to the exhibit. If the monitored interface for the primary FortiManager device fails, what must you do to maintain high availability (HA)?
- A. Manually promote one of the working secondary devices to the primary role: and reboot the original primary device to remove the peer IP address of the failed device.
- B. The FortiManager HA failover is transparent to administrators and does not require any additional action.
- C. Reconfigure the primary device to remove the peer IP address of the failed device from its configuration.
- D. Check the integrity database of the primary device to force a secondary device to become the new primary with all active interfaces.
Answer: B
Explanation:
In a FortiManager HA cluster configured with VRRP failover, the failover process is automatic and transparent to administrators. If the monitored interface on the primary device fails, the secondary device takes over without requiring manual intervention to maintain HA.
NEW QUESTION # 23
The administrator uses FortiManager to push a CLI script using the Remote FortiGate Directly (via CLI) option to configure an IPsec VPN. However, when running the script, the administrator receives the following error:
config vpn ipsec phase2-interface [parameter(s) invalid. detail: object mismatch] What must the administrator do to resolve the script error and successfully apply the IPsec configuration?
- A. Use IPsec templates to deploy provisioning templates.
- B. Run the script using the policy package or ADOM database method.
- C. Add a second config vpn ipsec phase2-interface block without linking it to phase1.
- D. Add the end command after finishing the IPsec phase 1-interface configuration block.
Answer: B
Explanation:
Running the script through the policy package or ADOM database method allows FortiManager to properly interpret object relationships and dependencies in the IPsec configuration, preventing object mismatch errors when pushing complex VPN settings directly via CLI.
NEW QUESTION # 24
An administrator configures a new BGP peer in the FortiManager device-level database of FortiGate. They reinstall the policy package to the managed FortiGate device without any errors. However, when the administrator logs in to FortiGate, they do not see the BGP configuration changes.
What is the most likely reason why FortiManager did not push the BGP peer changes to FortiGate?
- A. The administrator must use the Install Wizard and select Install device settings only to push BGP settings
- B. The FortiGate firmware version is different from the FortiManager ADOM version.
- C. The administrator must run a sanity check on FortiManager to make sure the database is not corrupted.
- D. Fortigate has a BGP template assigned on the FortiManager database.
Answer: D
Explanation:
If a BGP template is assigned to the FortiGate device on FortiManager, device-level BGP configurations made directly in the device-level database are overridden by the template settings, so the changes do not get pushed to the device.
NEW QUESTION # 25
An administrator has a FortiGate-HQ device with VDOMs-root, HR and Facilities, currently managed under the FortiManager ADOM-Site1. They try to move VDOM HR to the FortiManager ADOM-Site2, but it does not work.
Why is the administrator not able to move FortiGate-HQ VDOM HR to FortiManager ADOM-Site2?
- A. FortiManager must be in ADOM normal mode, which does not allow VDOMs to be managed separately.
- B. The FortiGate-HQ must be managed under the FortiManager ADOM-root to allow moving its VDOMs to different ADOMs.
- C. The administrator must have full access in the device layer of FortiGate-HQ VDOM-root before they can VDOMs to different ADOMs.
- D. The administrator must delete the FortiGate-HQ device from FortiManager and add it again using the Add Device wizard before moving the VDOM.
Answer: B
Explanation:
FortiGate devices must be managed under the FortiManager ADOM corresponding to the root VDOM to allow their individual VDOMs to be moved and managed in different ADOMs. Managing the root VDOM in a different ADOM prevents moving subordinate VDOMs across ADOMs.
NEW QUESTION # 26
You want to let multiple administrators work in the same ADOM without creating configuration conflicts.
What is the best and the most effective solution to apply?
- A. Activate workspace mode in the ADOM settings.
- B. Configure RADIUS authentication to assign ADOM roles to each user.
- C. Assign administrators with JSON API access to the FortiManager.
- D. Enable workflow mode, which is the only way to prevent concurrent configuration conflicts.
Answer: A
Explanation:
Activating workspace mode in the ADOM settings allows multiple administrators to work concurrently in the same ADOM by isolating their configuration changes in separate workspaces, preventing conflicts and enabling effective collaboration.
NEW QUESTION # 27
Which output is displayed right after moving the ISFW device from one ADOM to another?
- A.
- B.
- C.
- D.
Answer: A
Explanation:
Never Installed - The assigned policy package is not the result of an import for this device, and the package has not been installed since it has been assigned to this device.
NEW QUESTION # 28
What must you consider before deciding to use FortiManager to manage a FortiAnalyzer device?
- A. Check whether FortiManager is part of a high availability (HA) cluster.
- B. Ensure that FortiAnalyzer features are installed in advance.
- C. Determine whether the VDOMs of the same FortiGate will be assigned to different ADOMs.
- D. Confirm that FortiManager has enough storage capacity for the expected logs.
Answer: C
Explanation:
When FMG is managing a FAZ, you cannot switch to advanced mode. And it s only in advanced mode Vdoms of the same Fortigate can be assigned to differents ADOM.
NEW QUESTION # 29
Refer to the exhibits.
An administrator needs to push a FortiToken Mobile to assign it to HR_user in the HQ-NGFW-1.
However, when installing the policy package, they receive the following error message:
Why is the administratornotable to install the FortiToken on the HQ-NGFW-1 firewall?
- A. The administrator must use a valid FortiToken that exists on HQ-NGFW-1.
- B. The administrator must use a user local meta field to assign FortiToken.
- C. The administrator must use a metadata variable to assign the same FortiToken to multiple users in FortiManager.
- D. The administrator must use per-device mapping to assign the FortiToken to HQ-NGFW-1.
Answer: A
Explanation:
The error occurs because the FortiToken used (FTKM0B4A9AC5C56D) must already exist and be registered on the FortiGate device HQ-NGFW-1. FortiManager cannot push or create new FortiTokens on the device; the token must be valid and present on the FortiGate before it can be assigned to a user.
NEW QUESTION # 30
An administrator must create a policy and install it on a FortiGate device within an ADOM in backup mode.
How can the administrator perform this task?
- A. Make sure the ADOM and FortiGate firmware versions match and use the ADOM policy package.
- B. Use a FortiManager script to apply the configuration changes.
- C. Enable workflow mode to allow policy creation and approval.
- D. Use the Install Wizard located on the device manager.
Answer: B
Explanation:
In backup mode, FortiManager does not directly manage policy installation via the usual ADOM policy packages; instead, administrators use FortiManager scripts to push configuration changes, including policies, to FortiGate devices.
NEW QUESTION # 31
Refer to the exhibit.
What can you conclude from the downloaded import report?
- A. As a result of this policy import process, FortiManager will create a new firewall address called REMOTE_SUBNET in the ADOM database.
- B. FortiManager does not support per-device mapping for firewall addresses.
- C. FortiManager will change the configuration of REMOTE_SUBNET to match the interface mapping coming in from Remote-FortiGate.
- D. The administrator will see a new policy package named Remote-FortiGate_root in the FortiManager ADOM database.
Answer: D
Explanation:
The import report shows that a new policy package named Remote-FortiGate_root will be created in the FortiManager ADOM database, but some firewall addresses and policies failed to import due to interface binding conflicts.
NEW QUESTION # 32
A service provider administrator has assigned a global policy package to a managed customer ADOM named My_ADOM. The customer administrator has access only to My_ADOM.
How can the customer administrator edit the global header policy of the global policy package?
- A. The customer administrator can edit the header policy by using workflow mode on the global ADOM and My_ADOM.
- B. The service provider administrator can unlock the global policy from the global ADOM to authorize changes to the customer administrator.
- C. The customer administrator can edit the header policy by using workspace mode on the global ADOM.
- D. The customer administrator cannot edit the global header policy; only the service provider administrator can make changes from the global ADOM.
Answer: D
Explanation:
The global policy package is managed only from the global ADOM by the service provider administrator.
Customer administrators with access solely to their ADOM (My_ADOM) cannot edit the global header policy; such changes must be made by the service provider administrator in the global ADOM.
NEW QUESTION # 33
Refer to the exhibit. An administrator added a FortiGate device to FortiManager with the default object settings at the ADOM layer.
What can you conclude from the import policy package process of the HQ-NGFW- 1 device?
- A. The administrator must manually create the port4 interface on the ADOM layer to avoid import policy errors.
- B. The administrator must select Per Platform for all interfaces to correctly detect all interfaces from HQ-NGFW-1.
- C. FortiGate may not work as expected when the administrator does not import all objects.
- D. FortiManager will create LAN, port4, and port6 as normalized interfaces at the ADOM layer.
Answer: D
Explanation:
The import process shows that FortiManager will create normalized interfaces named LAN, port4, and port6 at the ADOM layer, mapping them to the corresponding device interfaces based on the import settings.
NEW QUESTION # 34
Push updates are failing on a FortiGate device located behind a network address translation (NAT) device?
Which two settings should the administrator check to correct this problem? (Choose two.)
- A. Make sure the virtual IP address and the correct ports are configured on the NAT device.
- B. Make sure FortiGuard updates and web service are enabled on the FortiGuard service interface.
- C. Make sure the Bind to IP address option on the FortiGuard service interface is set to the virtual IP address from the NAT device.
- D. Make sure the NAT device IP address and the correct ports are configured on FortiManager.
Answer: A,D
Explanation:
FortiManager must have the NAT device's IP address and correct ports configured to communicate properly with the FortiGate behind NAT.
The NAT device must have the correct virtual IP address and ports configured to allow push updates to reach the FortiGate device.
NEW QUESTION # 35
Refer to the exhibit. What are two results from the configuration shown in the exhibit? (Choose two.)
- A. The administrator must have access to the ADOM to approve changes.
- B. Ungraceful closed sessions will keep the ADOM in a locked state until the administrator session times out.
- C. The administrator can lock policy blocks and FortiManager global ADOM.
- D. The same administrator can lock more than one ADOM at the same time.
Answer: B,C
Explanation:
In normal workspace mode, ungraceful session closures will keep the ADOM locked until the session times out, preventing other administrators from editing. Normal workspace mode allows administrators to lock policy blocks and the global ADOM, providing granular locking control.
NEW QUESTION # 36
You are moving managed FortiGate devices from one ADOM to a new ADOM.
Which statement correctly describes the expected result?
- A. Any unused objects from a previous ADOM are moved to the new ADOM automatically.
- B. The shared device settings will be installed automatically.
- C. The shared policy package will not be moved to the new ADOM automatically.
- D. Policy packages will be imported into the new ADOM automatically.
Answer: C
Explanation:
When you move devices from one ADOM to another ADOM, shared policy packages and objects do not move to the new ADOM. You will need to import policy packages from managed devices.
NEW QUESTION # 37
......
100% Free FCP_FMG_AD-7.6 Files For passing the exam Quickly: https://exams4sure.pdftorrent.com/FCP_FMG_AD-7.6-latest-dumps.html