Free FCP-FMG-AD-7-6 sample questions

Correct answer: Use the Global ADOM to create a policy package with header and/or footer policies containing the compliance rules.

The Global ADOM is specifically designed for this purpose. Header and footer policies are enforced globally and cannot be modified within individual ADOMs, ensuring compliance. Local ADOM administrators can then add their own policies between the header and footer policies, fulfilling all requirements efficiently.

Correct answer: The script is not correctly retrieving or parsing the meta field variable, or the meta field is not populated for the failing devices.

TCL scripts rely on correct syntax to reference variables like meta fields (e.g., using `$(meta_field_name)`). The script's failure on only some devices strongly suggests that either the script logic for handling the variable is flawed, or the 'VLAN_IP' meta field has not been assigned a value for those specific devices, causing the script to fail when it tries to reference a null or empty value.

Correct answers: A separate ADOM for each business unit.; The Global ADOM.

Creating a separate ADOM for each business unit is the standard and most effective way to achieve management isolation for devices, policies, and objects.

The Global ADOM is specifically designed to create and manage objects and policies that can be shared and enforced across multiple regular ADOMs, which perfectly fits the requirement for a central security team to manage common security profiles.

Correct answer: True

This statement is True. In a standard active-passive FortiManager HA cluster, the primary unit handles all management tasks, including communication with FortiGate devices. The secondary (passive) unit maintains a synchronized copy of the configuration and database but remains idle with respect to device management until it is promoted to the primary role during a failover event.

Correct answer: Select the "Branch-Offices" device group, choose "Install Wizard", and perform a "Device Settings (Install Only)" operation to push the last known good configuration from FortiManager to the devices, overwriting the local changes.

The core issue is that the devices are out-of-sync with an incorrect local configuration. The most direct and scalable way to fix this is to force FortiManager's version of the configuration onto the devices. Using the "Install Wizard" for "Device Settings" does exactly this. It overwrites the unintended local changes made by the faulty script with the configuration stored in the FortiManager database, restoring service and bringing the devices back into a "synchronized" state.

Correct answer: The administrator will be able to create the new address object, as object creation is independent of policy package locks.

In FortiManager's Workspace Mode, locking is granular and applies to specific objects or policy packages, not the entire ADOM database. The second administrator can create a new address object because it is a separate entity from the locked policy package. They would only be blocked if they tried to modify an object already in use by the locked package or the locked package itself.

Correct answer: On the FortiGate, configure the `set central-management` type to `fortimanager` and enable FGFM for device registration. The FortiGate must initiate the connection to the FortiManager.

When a FortiGate is behind a NAT device, FortiManager cannot initiate a connection to it. The connection must be initiated from the FortiGate to the FortiManager. The FortiGate FGFM protocol is designed for this purpose. The FortiGate uses its WAN interface to connect out to the FortiManager's public IP address, establishing a management tunnel that FortiManager can then use for management.

Correct answer: The objects are duplicates of existing objects in the FortiManager ADOM database but have different values.

During a policy import, FortiManager compares the objects from the FortiGate with the objects already in the ADOM database. If an object from the FortiGate has the same name as an existing ADOM object but with different attributes (e.g., a different IP address), FortiManager flags it as a conflict. This process, called normalization, requires the administrator to choose which version of the object to use.

Correct answer: From the System Settings > Dashboard, in the System Information widget, select "Backup".

The backup option in the System Information widget on the System Settings dashboard is the correct GUI method for creating a full system backup. This single `.dat` file contains all configurations for the entire FortiManager appliance, including system settings, all ADOMs, policies, objects, and device databases, making it ideal for a full system restore or migration.

Correct answer: Policies created in a local ADOM are processed after the Global ADOM's Header Policies, and the deny rule is being matched first.

FortiManager constructs the final policy table on the FortiGate by combining global and local policies in a specific order: Global Header Policies first, then Local ADOM Policies, and finally Global Footer Policies. Since the deny rule is in the Header Policy section, it is evaluated before any of the local ADOM's policies. The first matching rule is applied, so the deny rule in the global header blocks the traffic before the local allow rule is ever reached.