FCP_FMG_AD-7.6 Fortinet NSE 5 - FortiManager 7.6 Administrator Questions and Answers

The command set workspace-mode normal enables Workspace (ALL ADOMs) . The study guide states that in this mode “All ADOMs can be locked” and workspace mode lets administrators lock ADOMs, devices, policy packages, and objects. The lab guide then gives the exact behavior for ungraceful session closure: “If a session is not closed gracefully … FortiManager does not close the administrator session until it times out or the session is deleted. Until this time, the ADOM remains in a locked state.” That directly proves A .

C is also verified by the lab guide statement: “If an administrator locked one or more ADOMs, and then logs out of FortiManager, all of those ADOMs are unlocked.” The phrase “one or more ADOMs” confirms the same administrator can lock multiple ADOMs at once.

D is a workflow mode approval concept, not workspace normal.

The command set workspace-mode normal enables Workspace (ALL ADOMs) . The study guide explicitly states that with this mode, “Workspace (ALL ADOMs): All ADOMs can be locked” and that enabling workspace mode “Disables concurrent read/write access to locked items” with “Read/write access for only one administrator—all others have read-only access.” That directly proves D .

A is also verified by the lab guide, which states: “If an administrator locked one or more ADOMs, and then logs out of FortiManager, all of those ADOMs are unlocked.” The phrase “one or more ADOMs” confirms that the same administrator can lock more than one ADOM at the same time.

C is incorrect because approval is required only in workflow mode , not in workspace normal.

=========

The error occurs because the FortiGate HQ-NGFW device with ID 262 is a newly added model device and has not yet been fully synchronized or installed with a configuration package, which causes the reload configuration command to fail.

The correct answer is D . In FortiManager HA manual mode, the study guide explains what happens when members change: if the primary fails, you must manually promote a secondary and repoint the others, but that is not this scenario. For a failed secondary , the relevant exact extract is: “if you remove a secondary member from the HA configuration, the primary FortiManager removes the secondary serial number from the central management configuration of FortiGate, and updates the managed FortiGate devices immediately.”

Operationally, in the HA configuration, removing that failed secondary means deleting its HA peer entry from the primary, which corresponds to removing the failed device’s peer IP . A is false because manual HA is not transparent in this case. B is only a diagnostic detail. C applies when the primary fails, not a secondary.

=========

The correct answer is D . The exact extract from the study guide says a revert operation “Reverts only the device database to the previous revision” and “Does not revert policies and objects—you must import them.” It further states: “Performing a revert operation followed by an installation only reverts device-level changes and does not revert policy packages.”

That exactly matches the CLI output. The device shows the device manager portion as installed and synchronized, while the policy package appears as unknown, which indicates the revert and installation affected the device-level configuration only . It did not reinstall or synchronize the policy package. Therefore B is incorrect. A is unsupported by the source, and C is unrelated because the firmware version is already shown in the device list output. The study guide also states that after revert you must use Import Configuration to synchronize policy information.

Meta fields in FortiManager can be added to objects as custom attributes, allowing administrators to categorize and add additional information to firewall objects for easier management and identification.

FortiManager must have the NAT device ' s IP address and correct ports configured to communicate properly with the FortiGate behind NAT.

The NAT device must have the correct virtual IP address and ports configured to allow push updates to reach the FortiGate device.

The correct conclusion is D . The FortiManager 7.6 Administrator Study Guide defines Never Installed as a state where the policy package was never created and was never imported for a managed device . That means FortiManager may already know the device itself at the device layer, but the firewall policy layer has not yet been built for that device.

The lab guide confirms this behavior directly: when you choose Import Later in the Add Device wizard, the policy package status becomes Never Installed because there is still no policy package created for the added FortiGate devices.

So this is not a revision-history issue, and it does not mean ADOM policy changes are merely waiting for first install. It means the policies still exist only on the managed device side until they are imported into a FortiManager policy package.

=========

The exhibit shows a FortiManager HA cluster with one primary and one secondary member. The FortiManager 7.6 Administrator Study Guide clearly states that if FortiAnalyzer features are enabled, you cannot configure FortiManager HA , so in an HA environment like the one shown, FortiAnalyzer features are not enabled . That makes D the correct answer.

A is incorrect because the study guide explicitly says you do not need to reboot a device when promoting it from secondary to primary.

C is incorrect because the failover mode shown is Manual , not VRRP automatic failover , so failover does not occur automatically based on heartbeat loss.

B is not the best answer here because FortiGuard packages are downloaded separately rather than synchronized as HA data, but the exhibit’s key provable conclusion is the HA restriction on FortiAnalyzer features.

=========

ADOM revisions save the current state of all policy packages and objects within an ADOM, allowing administrators to track changes over time and revert to previous configurations if needed.

The FortiManager 7.6 Administrator Study Guide states that global policies must be explicitly assigned : “ You must explicitly assign global policy packages to specific ADOMs ,” and FortiManager can also target specific policy packages in individual ADOMs . The lab guide confirms that assignment is performed from the Global Database ADOM : the administrator selects Global Database ADOM , clicks Assignment , adds the ADOM, chooses Specify Policy Packages To Assign , selects the target package, and then clicks Assign .

So creating a new policy package inside ADOM1 does not automatically inherit the existing global package assignment. It also does not automatically install policies. The administrator must go back to the global ADOM and assign the global policy package to that new local policy package.

The exhibit shows Remote-FortiGate with a green closed lock icon , which indicates a locked policy package . The FortiManager 7.6 Administrator Study Guide states: “Policy locking is available in workspace normal and per-ADOM modes” and “Policy locking allows administrators to work on and lock a single policy package instead of locking the whole ADOM.” This confirms that a package such as Local-FortiGate_root can also be locked, so A is correct.

B is incorrect because the study guide and lab guide describe snapshots as ADOM revisions , not policy package snapshots: “An ADOM revision creates a snapshot of the policy and object configuration for the ADOM.”

D is incorrect because in workflow mode, sessions and approval are required before installation. The exhibit shows a normal save/lock state, not a workflow session state.

=========

The correct answer is D . The lab guide explains that when an installation fails, the installation log shows the commands that the managed device received and accepted, as well as the commands that the managed device did not accept .

From the exhibit, FortiGate accepted the policy creation commands for policy ID 2 such as set srcintf port3, set dstintf port1, set srcaddr all, set dstaddr all, set action accept, and set schedule always. However, the line set users student failed with “entry not found in datasource” and “value parse error before ' student ' ” . That shows the user reference was not accepted, while the rest of the policy commands were processed. Therefore, policy ID 2 is still created, but without the remote user student . This rules out A , B , and C .

=========

The correct answer is C . The FortiManager 7.6 Administrator Study Guide states that after adding the root FortiGate of a Security Fabric, all downstream devices in the fabric are automatically added as Unauthorized in the root ADOM . That directly matches option C.

This is important because the administrator created a FortiGate-only ADOM named Training, not a Fabric ADOM. The lab guide explains that a FortiGate ADOM is intended for FortiGate devices, while the Fabric type is the special ADOM type that allows FortiGate and other device types together.

So the downstream members are not automatically authorized, and they do not immediately appear as managed devices inside the Training ADOM. They first appear as unauthorized devices in the root ADOM , where the administrator can review and authorize them.

=========

The global policy package is managed only from the global ADOM by the service provider administrator. Customer administrators with access solely to their ADOM (My_ADOM) cannot edit the global header policy; such changes must be made by the service provider administrator in the global ADOM.

The FortiManager 7.6 Administrator Study Guide states under Copying System Templates Between ADOMs : “The first step is to export the system template from the original ADOM with the execute fmprofile export-profile command” and shows the output file being written to /tmp/Training , described as “File copied in FortiManager tmp folder.”

The key point is that the command exports the system template profile from the original ADOM , while /tmp/Backup_File is only the destination path on FortiManager where the exported file is stored. The same study guide also defines system templates as a “subset of model device configuration—system-level settings” , which means they belong to the device-level side of the ADOM , not the policy database.

So the export source is the ADOM device database , and the file is saved afterward in the FortiManager /tmp folder.