FCP_FMG_AD-7.6 Fortinet NSE 5 - FortiManager 7.6 Administrator Questions and Answers

The error occurs because the FortiToken used (FTKM0B4A9AC5C56D) must already exist and be registered on the FortiGate device HQ-NGFW-1. FortiManager cannot push or create new FortiTokens on the device; the token must be valid and present on the FortiGate before it can be assigned to a user.

Limiting ADOM revisions reduces the number of stored historical configurations, which helps avoid performance degradation and slow ADOM upgrades caused by a large volume of revisions.

Using the Install Wizard is the recommended method to reinstall the central policy package on the BR1-FGT-1 firewall, ensuring all settings, installation targets, and dependencies are correctly processed during installation.

Running a script on the Device Database marks the configuration as modified but does not immediately apply changes to the device.

The administrator must use the Install Wizard to push and install these changes from the Device Database onto the managed device.

The correct answer is C . The FortiManager 7.6 Administrator Study Guide explicitly says: “You must explicitly assign global policy packages to specific ADOMs” and “you can even pick specific policy packages in individual ADOMs that you want to apply the global policies to.” The study guide also explains the assignment workflow: “This slide shows the steps to assign a global policy package to an ADOM policy package” and “First, add the required ADOMs as targets. Second, assign the global policy package to the ADOMs.”

Because Remotes is a newly created policy package, it does not inherit the earlier assignment automatically. The administrator must explicitly assign the Training global policy package to the Remotes policy package. Automatic install does not create that assignment, and unassigning all packages is unnecessary.

The most strongly supported answer is A . The study guide explicitly states: “In the case of having multiple FortiOS firmware versions on the same ADOM, it is recommended to use separate ADOMs instead.” It also says: “When you organize managed FortiGate devices, it is highly recommended that you group them based on their FortiOS firmware version. This is because valid command syntax varies by firmware version, which affects script compatibility.”

D is the other practical fix supported by FortiManager workflow. The study guide states that FortiManager can run scripts on multiple managed devices at once , and device groups let you run scripts on multiple devices instead of a single device . Combined with the firmware-version compatibility rule above, the correct operational approach is to keep version-specific scripts and apply them only to the matching device sets. B and C are not supported by the uploaded study guide as the recommended fix.

=========

The FortiManager 7.6 Administrator Study Guide states that global policies must be explicitly assigned : “ You must explicitly assign global policy packages to specific ADOMs ,” and FortiManager can also target specific policy packages in individual ADOMs . The lab guide confirms that assignment is performed from the Global Database ADOM : the administrator selects Global Database ADOM , clicks Assignment , adds the ADOM, chooses Specify Policy Packages To Assign , selects the target package, and then clicks Assign .

So creating a new policy package inside ADOM1 does not automatically inherit the existing global package assignment. It also does not automatically install policies. The administrator must go back to the global ADOM and assign the global policy package to that new local policy package.

The import process shows that FortiManager will create normalized interfaces named LAN, port4, and port6 at the ADOM layer, mapping them to the corresponding device interfaces based on the import settings.

The exhibits are directly supported by the lab guide’s troubleshooting section. It states: “The only profile that can be replaced is the Firewall Profile-Protocol-Options profile, because the only difference is a change in the comment field.” It then explains that for the other two profiles, “Whether you accept the value from BR1-FGT-1 or FortiManager, it will cause changes on different devices.”

That exactly matches C . The conflict window is not primarily showing a firmware mismatch, and the guide does not say BR1-FGT-1 lacks HTTPS 443 support. It also does not describe this as a FortiGuard database mismatch for QUIC. Instead, the key point is that only the default Firewall Profile-Protocol-Options conflict is minor enough to safely take from FortiManager because the difference is only in the comment field . The web filter and SSL/SSH profiles would cause real configuration differences if replaced.

The correct answer is C . The installation log explicitly says: “Dynamic interface ‘LAN’ mapping undefined for device HQ-NGFW-1” . That means the policy is using a normalized interface , but FortiManager has no valid mapping for that device. The FortiManager 7.6 Administrator Study Guide states that “Interfaces are mapped per device, per platform, or both” and “When the normalized interface is used in a policy, the per-device mappings have higher priority than per-platform mappings.”

The lab guide also shows that during import or policy mapping fixes, the administrator can set the Mapping Type to Per-Device for interfaces.

So the correct fix is to create a per-device mapping for the normalized interface LAN for that FortiGateRugged-70F. Hardcoding lan1 in the policy is not the best FortiManager method because interface mapping is designed specifically to avoid that.

=========

The command set workspace-mode normal enables Workspace (ALL ADOMs) . The study guide explicitly states that with this mode, “Workspace (ALL ADOMs): All ADOMs can be locked” and that enabling workspace mode “Disables concurrent read/write access to locked items” with “Read/write access for only one administrator—all others have read-only access.” That directly proves D .

A is also verified by the lab guide, which states: “If an administrator locked one or more ADOMs, and then logs out of FortiManager, all of those ADOMs are unlocked.” The phrase “one or more ADOMs” confirms that the same administrator can lock more than one ADOM at the same time.

C is incorrect because approval is required only in workflow mode , not in workspace normal.

=========

If a BGP template is assigned to the FortiGate device on FortiManager, device-level BGP configurations made directly in the device-level database are overridden by the template settings, so the changes do not get pushed to the device.

The correct answer is D . The FortiManager 7.6 Administrator Study Guide states: “You can revert to a previous configuration revision” and “Reverts only the device database to the previous revision” . It also states “Does not revert policies and objects—you must import them” and “You must install reverted changes on FortiGate.”

This exactly means a revert operation changes the device-level database on FortiManager, not the policy layer database. The guide further clarifies: “Performing a revert operation followed by an installation only reverts device-level changes and does not revert policy packages.”

So C is incorrect because both layers are not reverted together. A and B are also incorrect because the documented and verified effect is specifically a modification of the device database , followed by install and, if needed, policy re-import for synchronization.

=========

The correct answer is D . The exact extract from the study guide says a revert operation “Reverts only the device database to the previous revision” and “Does not revert policies and objects—you must import them.” It further states: “Performing a revert operation followed by an installation only reverts device-level changes and does not revert policy packages.”

That exactly matches the CLI output. The device shows the device manager portion as installed and synchronized, while the policy package appears as unknown, which indicates the revert and installation affected the device-level configuration only . It did not reinstall or synchronize the policy package. Therefore B is incorrect. A is unsupported by the source, and C is unrelated because the firmware version is already shown in the device list output. The study guide also states that after revert you must use Import Configuration to synchronize policy information.

The exhibit shows the default value of the LAN address object as 172.16.5.0/255.255.255.0 . It also shows Per-Device Mapping entries only for BR1-FGT-1 [root] , HQ-NGFW-1 [root] , and Remote-Firewall [root] . There is no mapping shown for Remote-Firewall [VDOM1] .

The FortiManager 7.6 Administrator Study Guide gives the exact rule: “The devices in the ADOM that do not have a dynamic mapping for LAN have a default value.” It also states that dynamic mappings are configured per device in the Per-Device Mapping section.

Since Remote-Firewall [VDOM1] does not have its own mapping entry, it will use the object’s default value , which is 172.16.5.0/255.255.255.0 .

The correct answer is B . The FortiManager 7.6 Administrator Study Guide explicitly states: “CLI scripts use the FGFM tunnel and the FGFM tunnel is authenticated using the FortiManager and FortiGate serial numbers.” It also states: “Tcl scripts do not run through the FGFM tunnel like CLI scripts do. Tcl scripts use SSH to tunnel through FGFM and they require SSH authentication to do so.”

This is the exact reason CLI scripts can run without prompting for SSH authentication every time: they use the existing secure FGFM management tunnel , not a separate interactive SSH login. The FGFM section of the study guide also confirms that this is a secure communication tunnel established between FortiManager and managed FortiGate devices.

So the enabler is not legacy login, script location, or the “Remote FortiGate Directly” option by itself. It is the FGFM secure management tunnel .