FCP_FMG_AD-7.6 Free Practice Test

Push updates are failing on a FortiGate device located behind a network address translation (NAT) device? Which two settings should the administrator check to correct this problem? (Choose two.)

1. A. Make sure the NAT device IP address and the correct ports are configured on FortiManager.
2. B. Make sure FortiGuard updates and web service are enabled on the FortiGuard service interface.
3. C. Make sure the virtual IP address and the correct ports are configured on the NAT device.
4. D. Make sure the Bind to IP address option on the FortiGuard service interface is set to the virtual IP address from the NAT device.

Correct Answer: AC
FortiManager must have the NAT device's IP address and correct ports configured to communicate properly with the FortiGate behind NAT.
The NAT device must have the correct virtual IP address and ports configured to allow push updates to reach the FortiGate device.

While attempting to push a NetFlow configuration script through the FortiManager policy package: an administrator encounters an error stating that an object is unrecognized in line 4.

What must the administrator do to successfully apply the NetFlow configuration script and avoid the object unrecognized error?

1. A. Make sure the user running the script has full access to the VDOM—AGEUSR.
2. B. Run the script on the device database.
3. C. Use metadata variables if they use VDOMs in the script.
4. D. Create a normalized interface on the policy layer before running the script.

Correct Answer: C
When using scripts that reference VDOM-specific objects, such as interfaces, in FortiManager, metadata variables must be used to correctly map those objects per VDOM. This prevents "object unrecognized" errors during script execution.

Which is recommended when you are managing a high volume of logs in your network?

1. A. Store logs on FortiManager and use FortiView.
2. B. Add and manage FortiAnalyzer from FortiManager.
3. C. Enable advanced ADOM mode on FortiManager.
4. D. Forward logs from FortiAnalyzer to FortiManager daily.

Correct Answer: B
Adding and managing FortiAnalyzer from FortiManager is recommended for handling a high volume of logs, as FortiAnalyzer is designed specifically for centralized log management, analysis, and reporting, which offloads this workload from FortiManager.

Company policy dictates that any time a change is made to a policy package on FortiManager an ADOM revision is created before the change installed, and that revision is held for a minimum of 90 days.
Over the past three months, each installed change has resulted in several unused policies and duplicate objects. The FortiManager administrator plans to upgrade the FortiGate devices and then upgrade the FortiManager ADOM from version 7.4 to 7.6.
Which action can the administrator take to avoid slow ADOM upgrades?

1. A. Check and repair the global configuration database before upgrading.
2. B. Export firewall policies to Excel, delete them on the ADO
3. C. then reimport them after upgradingthe ADOM.
4. D. Find unused firmware templates, then delete them before upgrading.
5. E. Limit ADOM revisions before upgrading.

Correct Answer: D
Limiting ADOM revisions reduces the number of stored historical configurations, which helps avoid performance degradation and slow ADOM upgrades caused by a large volume of revisions.

After correcting a policy package configuration issue, you want to prevent administrators from repeating the mistake that caused the issue.
Which FortiManager approach best meets this need?

1. A. Configure an TCL script to run locally on FortiManager for each FortiGate.
2. B. Restrict administrators with an administration profile from viewing the revision history to limit who can make changes.
3. C. Enable the change note to require administrators to add a note whenever they change object configurations.
4. D. Enable a workflow requiring approval before installing policy packages on any FortiGate.

Correct Answer: D
Enabling a workflow with approval ensures that any policy package changes must be reviewed and approved before installation, preventing administrators from repeating configuration mistakes and enforcing change control.