FCP_FMG_AD-7.4 Sample Questions Answers

If the script is run using the "Device Database" option on FortiManager, the following occurs:

A.You must install these changes on a managed device using the Install Wizard.

Running the script on the Device Database updates only the configuration in the FortiManager's database, not on the actual FortiGate device. To apply the changes, you need to use the Install Wizard to push these configurations to the managed device.

D.The device Config Status is tagged as Modified.

After running the script on the Device Database, FortiManager tags the device's configuration status as "Modified," indicating that there are pending changes that have not yet been installed on the device.

Options B and C are incorrect because:

Bsuggests a new revision history is created, but this only happens when changes are actually installed on the managed device.

Cimplies the script is directly executed on the FortiGate, which is not the case when using the Device Database option.

FortiManager References:

Refer to FortiManager 7.4 Administrator Guide: Scripting and Configuration Management.

The statement that is true about the policy lock feature on FortiManager is:

A. Policy locking is available in workspace normal mode.

In FortiManager, when working in "workspace-mode normal," policies can be locked by administrators to prevent other administrators from editing them simultaneously. This ensures that only one administrator makes changes at any given time, reducing conflicts or mistakes due to concurrent modifications.

Statements B, C, and D are incorrect because:

B is incorrect since locking a policy does not override a locked ADOM. The ADOM lock takes precedence.

C is incorrect because when a policy is locked, it does not necessarily mean the ADOM is locked.

D is incorrect because administrators in the approval group cannot work concurrently on a locked policy; the policy lock prevents concurrent modifications.

FortiManager References:

Refer to FortiManager 7.4 Administrator Guide: Policy and Objects > Policy Locking to understand how the policy lock feature functions in different workspace modes.

The characteristic of the FortiManager high availability (HA) feature is that the primary unit synchronizes all configuration revisions with the secondary units. This ensures that all devices in the HA cluster are up-to-date with the same configurations, providing redundancy and failover capabilities.

Options A, C, and D are incorrect because:

Arefers to a specific port number (5199), but FortiManager does not specifically use TCP port 5199 to update managed devices when a secondary unit is removed.

Cis incorrect as secondary units do not necessarily have to be in the same network as the primary unit; they just need to be able to communicate with each other.

Dis incorrect because HA upgrades can be automated and do not require manual upgrading, starting with the primary unit.

FortiManager References:

Refer to FortiManager 7.4 High Availability (HA) Guide: HA Synchronization and Configuration.

Option B: It allows FortiManager to respond to requests for FortiGuard services from FortiGate devices.This is the correct answer. When Service Access is enabled on FortiManager, it allows FortiManager to act as a local FortiGuard server for the managed FortiGate devices. This enables the FortiManager to respond to requests for FortiGuard services, such as updates for antivirus, web filtering, and other security services.

Explanation of Incorrect Options:

Option A: It allows administrative access to FortiManageris incorrect because Service Access is specifically for FortiGuard service communication, not for administrative access.

Option C: It allows third-party applications to gain read/write access to FortiManageris incorrect because Service Access does not provide API or third-party access capabilities.

Option D: It allows FortiManager to determine the connection status of managed devicesis incorrect because Service Access does not directly manage or check connectivity status of devices; it is used for FortiGuard service requests.

FortiManager References:

Refer to the "FortiManager Administration Guide," particularly the sections on "Service Access Settings" and "FortiGuard Services."

When push updates are failing on a FortiGate device behind a NAT device, the administrator should check:

A.That the override server IP address is set on FortiManager and the NAT device.

The override server IP should be configured to ensure that FortiManager uses the correct IP address that can traverse the NAT to reach the FortiGate device.

D.That the virtual IP address and correct ports are set on the NAT device.

The NAT device must have the correct virtual IP (VIP) configured to map the FortiGate's internal IP to an external address, along with the correct ports needed for communication.

Options B and C are incorrect because:

Bsuggests setting the external IP on the NAT device to DHCP, which is not relevant to solving the push update issue.

Cimplies configuring NAT device IP and ports on FortiManager, which is less likely needed compared to configuring the correct VIP and ports.

FortiManager References:

Refer to FortiManager 7.4 Administrator Guide: Device Management and NAT Configuration.

The configuration shown in the exhibit sets theworkspace-mode to normal. The workspace mode in FortiManager defines how configuration changes and administrative tasks are handled, specifically regarding locking and collaboration in ADOMs (Administrative Domains).

Understanding the workspace modes:

Normal Mode:In this mode, only one administrator at a time can lock and edit an ADOM. The changes made by one administrator must be completed and saved before another administrator can make changes. It prevents concurrent read-write access within the same ADOM.

Workflow Mode:This mode allows multiple administrators to work on different tasks within the same ADOM, but changes still need to be approved before being committed.

Explanation of Options:

A. You can validate administrator login attempts through external servers.

This option is unrelated to the workspace mode. External authentication servers can be used for administrator logins, but that is a different configuration setting (not related to workspace-mode).

B. The same administrator can lock more than one ADOM at the same time.

This istrue. InNormal mode, an administrator can lock multiple ADOMs, meaning they can work on more than one ADOM simultaneously, but each ADOM can only be accessed by one administrator at a time for read-write purposes.

C. Two or more administrators can make configuration changes at the same time, in the same ADOM.

This isfalse. InNormal mode, onlyone administratorcan have read-write access to an ADOM at a time. If another administrator attempts to make changes, they must wait until the ADOM is unlocked by the first administrator.

D. Concurrent read-write access to an ADOM is disabled.

This istrue. InNormal mode, concurrent read-write access is disabled. This means only one administrator at a time can make changes to an ADOM. Other administrators can view the ADOM in read-only mode but cannot make changes until the ADOM is unlocked.

Option A: To assign another global policy package later to the same ADOM, you must unassign this policy first.This is correct. FortiManager does not allow multiple global policy packages to be assigned to a single ADOM simultaneously. If you want to assign a different global policy package, the existing one must be unassigned first.

Option C: You can edit or delete all the global objects in the global ADOM.This is correct. Once a global policy package is assigned, you have the flexibility to edit or delete global objects in the global ADOM, affecting all ADOMs to which this package is assigned.

Explanation of Incorrect Options:

Option B: After you assign the global policy package to an ADOM, the impacted policy packages become hidden in that ADOMis incorrect because the policy packages do not become hidden; they are modified according to the global policies.

Option D: You must manually move the header and footer policies after the policy assignmentis incorrect because header and footer policies are automatically applied when assigned.

FortiManager References:

See the "Global Policy and ADOM Management" section in the FortiManager Administration Guide.