Fortinet FCP_FMG_AD-7.6 Exam Questions Instant Access

Question 1

An administrator sees that the policy package status of HQ-NGFW-1 is Never Installed. What can you conclude from this status? Choose one answer

AThe policies have not yet been retrieved from the HQ-NGFW-1 device-level database of FortiManager.

BThe policy package was never imported to the revision history after HQ-NGFW-1 was registered on FortiManager.

CThe firewall policies were created or changed in the ADOM, and they need to be installed on the managed HQ-NGFW-1 for the first time.

DThe firewall policies exist only in the HQ-NGFW-1 device-level database, and no policy package has been assigned to the firewall.

Answer : D

The correct conclusion is D. The FortiManager 7.6 Administrator Study Guide defines Never Installed as a state where the policy package was never created and was never imported for a managed device. That means FortiManager may already know the device itself at the device layer, but the firewall policy layer has not yet been built for that device.

The lab guide confirms this behavior directly: when you choose Import Later in the Add Device wizard, the policy package status becomes Never Installed because there is still no policy package created for the added FortiGate devices.

So this is not a revision-history issue, and it does not mean ADOM policy changes are merely waiting for first install. It means the policies still exist only on the managed device side until they are imported into a FortiManager policy package.

=========

Question 2

An administrator notices that CLI scripts are failing on some FortiGate devices because they use different FortiOS versions.

Which two actions should the administrator take to fix the failing CLI scripts? Choose two answers.

ACreate separate ADOMs for each FortiOS version.

BDisable CLI scripts for devices using older firmware.

CModify the CLI scripts to include conditional commands based on FortiOS version.

DCreate version-specific CLI script groups and assign them to the appropriate devices.

Answer : A, D

The most strongly supported answer is A. The study guide explicitly states: ''In the case of having multiple FortiOS firmware versions on the same ADOM, it is recommended to use separate ADOMs instead.'' It also says: ''When you organize managed FortiGate devices, it is highly recommended that you group them based on their FortiOS firmware version. This is because valid command syntax varies by firmware version, which affects script compatibility.''

D is the other practical fix supported by FortiManager workflow. The study guide states that FortiManager can run scripts on multiple managed devices at once, and device groups let you run scripts on multiple devices instead of a single device. Combined with the firmware-version compatibility rule above, the correct operational approach is to keep version-specific scripts and apply them only to the matching device sets. B and C are not supported by the uploaded study guide as the recommended fix.

=========

Question 3

Refer to the exhibits.

What can you conclude, based on the configuration shown in the exhibit? Choose one answer

AThe administrator needs to retrieve the Local-FortiGate configuration to sync with the Security Fabric group, Training.

BPolicy sequence #1 will be installed on the internal segmentation firewall ISFW device root NAT and Trainer NAT VDOMs.

CPolicy sequence #3 must have devices or VDOMs listed in the Install On column; otherwise, it will cause errors.

DThe global policy package will be added to the top of the ISFW policy package.

Answer : A

The best conclusion is A. From the exhibit, B is clearly incorrect because policy sequence #1 Ping_Access is targeted to ISFW root and ISFW Student, not to root NAT and Trainer NAT. Also, C is incorrect because FortiManager allows a rule to inherit Installation Targets. The study guide explains that a policy package can target one or more devices or VDOMs, and the Install On column is used only for per-rule exceptions in a shared policy package. A rule does not need explicit devices listed if it is meant to apply to the package's installation targets.

D is also incorrect because global header policies are created in the Global Database ADOM and placed at the top only when a global package is assigned. The exhibit shows a shared policy package, not a global ADOM header-policy assignment.

=========

Question 4

Refer to the exhibit.

An administrator has assigned the default system template to install all devices with the FortiAnalyzer IP address 10.0.13.12. However, not all FortiGate devices can reach FortiAnalyzer using the default interface. Some devices may use the LAN interface, while others may use the WAN interface. How can the administrator change the source interface for FortiGate devices using the default system template? Choose one answer

AUse per-device dynamic object configurations at the ADOM level and apply them in the template.

BConfigure a metadata variable at the ADOM level and use it in the template.

CCreate a different system template for each FortiGate, if the configuration is different.

DCreate a meta field on FortiManager system settings of type Device and use it in the template.

Answer : B

The correct answer is B because FortiManager supports ADOM-level metadata variables in scripts and templates. The study guide explicitly states that meta fields cannot be used as variables in scripts or provisioning templates; instead, you must use ADOM-level metadata variables. It further says these variables can be used in templates, and their values can be mapped depending on the device where the template is applied.

That makes metadata variables the proper method for handling per-device differences such as whether a FortiGate should use a LAN or WAN source interface for FortiAnalyzer communication. A is wrong because per-device dynamic objects apply to objects like addresses and VIPs, not template interface selection. D is wrong because meta fields are comments/attributes, not template variables. C could work operationally, but it is not the FortiManager feature intended for this use case.

=========

Question 5

Refer to the exhibit.

An administrator created two new meta fields in FortiManager.

Which operation can you perform with these parameters?

AYou can add them to objects as custom attributes.

BYou can export them to be used in other ADOMs.

CYou can use them as variables in scripts.

DYou can invoke them using the $ character.

Answer : A

Meta fields in FortiManager can be added to objects as custom attributes, allowing administrators to categorize and add additional information to firewall objects for easier management and identification.

Question 6

Refer to the exhibit.

How does FortiManager get antivirus and IPS updates? Choose one answer

AIt uses all URLs in the list that contain the fds host name.

BIt gets updates from the server with IP address 10.0.1.50.

CIt connects to all servers marked as FortiGuard Distribution Network through Internet FDNI sources.

DIt connects to the public FortiGuard servers listed in the configuration

Answer : B

The exhibit shows diagnose fmupdate view-serverlist fds with Server Override Mode: Strict and the active entry marked with *0 as 10.0.1.50 on port 8890, with source CLI. In FortiManager, Strict override mode means the system can communicate only with the configured override server list and cannot fall back to public FDS servers. Therefore, FortiManager gets antivirus and IPS updates from 10.0.1.50, making B correct.

The study guide also explains that antivirus and IPS override addresses are specifically used when a downstream FortiManager must download updates from an upstream FortiManager or another designated server.

So even though FDNI and DEFAULT entries are listed, Strict mode prevents fallback, and only the CLI-defined override server is actually used.

=========

Question 7

An administrator created a new ADOM named Training for FortiGate devices only. Then, the administrator added the root FortiGate device of a Security Fabric group to the Training ADOM. Which statement correctly describes the expected result for the downstream devices in the Security Fabric, given the actions taken by the administrator? Choose one answer

AThe downstream devices are automatically authorized.

BThe downstream devices will appear in the Managed FortiGate section of the root ADOM.

CThe downstream devices show as unauthorized in the root ADOM.

DThe downstream devices must be added using the Add Device wizard.

Answer : C

The correct answer is C. The FortiManager 7.6 Administrator Study Guide states that after adding the root FortiGate of a Security Fabric, all downstream devices in the fabric are automatically added as Unauthorized in the root ADOM. That directly matches option C.

This is important because the administrator created a FortiGate-only ADOM named Training, not a Fabric ADOM. The lab guide explains that a FortiGate ADOM is intended for FortiGate devices, while the Fabric type is the special ADOM type that allows FortiGate and other device types together.

So the downstream members are not automatically authorized, and they do not immediately appear as managed devices inside the Training ADOM. They first appear as unauthorized devices in the root ADOM, where the administrator can review and authorize them.

=========

Fortinet NSE 5 - FortiManager 7.6 Administrator FCP_FMG_AD-7.6 Exam Questions