Fortinet FCP_FMG_AD-7.6 Practice Test 100

Question 990

After deploying FortiGate HA cluster onboarding into FortiManager to centrally manage a FortiGate HA cluster as an authorized managed device group, a reviewer requests operational evidence. Which result best satisfies the acceptance criterion?

Cluster membership reflects the actual physical or virtual FortiGate members
Inventory lists the replacement member and removes the stale reference appropriately
Expected active/passive or active-active member roles and health are visible
The cluster and its members appear in the managed-device inventory

Explanation

Correct Answer

The resulting evidence is specific to FortiGate HA cluster onboarding into FortiManager: the cluster and its members appear in the managed-device inventory. It demonstrates the requirement to centrally manage a FortiGate HA cluster as an authorized managed device group, rather than merely showing a configuration record was saved.

Incorrect Answers

This result would help verify FortiGate HA member serial inventory and its different task to distinguish an HA cluster's individual FortiGate units before applying a device-specific change. It does not establish that the requested FortiGate HA cluster onboarding into FortiManager outcome has been achieved.

This result would help verify FortiGate HA member replacement reconciliation and its different task to recover central inventory after replacing a failed HA member. It does not establish that the requested FortiGate HA cluster onboarding into FortiManager outcome has been achieved.

This result would help verify FortiGate cluster state verification and its different task to distinguish an HA member health incident from a FortiManager management-plane outage. It does not establish that the requested FortiGate HA cluster onboarding into FortiManager outcome has been achieved.

Question 991

An administrator states that FortiGate central-manager setting now allows them to direct a firewall to its intended FortiManager controller. Which check provides the strongest supporting evidence?

Accepted inventory no longer marks the device as awaiting authorization
The authorized FortiGate has an established management connection
Unauthorized administrator cannot approve the pending device
The firewall makes a management request to that intended manager

Explanation

Correct Answer

The resulting evidence is specific to FortiGate central-manager setting: the firewall makes a management request to that intended manager. It demonstrates the requirement to direct a firewall to its intended FortiManager controller, rather than merely showing a configuration record was saved.

Incorrect Answers

This result would help verify Pending FortiGate authorization approval and its different task to prevent unknown devices from entering the managed inventory without review. It does not establish that the requested FortiGate central-manager setting outcome has been achieved.

This result would help verify FGFM management channel and its different task to support persistent FortiGate-to-FortiManager management communication. It does not establish that the requested FortiGate central-manager setting outcome has been achieved.

This result would help verify Device authorization profile scope and its different task to restrict who can register a FortiGate in a customer ADOM. It does not establish that the requested FortiGate central-manager setting outcome has been achieved.

Question 992

A managed environment will use Admin profile and permission scope to restrict an operator to the FortiManager functions required for assigned duties. Which preparation check makes the chosen change viable?

Assign an administrative profile and approved ADOM scope to the account
Configure the LDAP server and bind settings before assigning LDAP admin type
Register the TACACS+ service endpoint and matching shared secret on FortiManager
Create an individual local administrator with an appropriate profile and password

Explanation

Correct Answer

The specific preparation for Admin profile and permission scope is to assign an administrative profile and approved ADOM scope to the account. This addresses the stated need to restrict an operator to the FortiManager functions required for assigned duties, and later acceptance is demonstrated when unauthorized editing tools are unavailable even after successful sign-in.

Incorrect Answers

That step belongs to LDAP-backed administrator, used to validate administrator credentials against the organization directory. It is not the mechanism-specific setup for Admin profile and permission scope required to restrict an operator to the FortiManager functions required for assigned duties.

That step belongs to TACACS+ administrator authentication, used to use TACACS+ for centrally managed privileged operator sign-ins. It is not the mechanism-specific setup for Admin profile and permission scope required to restrict an operator to the FortiManager functions required for assigned duties.

That step belongs to Local administrator account, used to grant a named break-glass operator managed access without external identity dependency. It is not the mechanism-specific setup for Admin profile and permission scope required to restrict an operator to the FortiManager functions required for assigned duties.

Question 993

The change record says Post-script revision recovery should recover after a script created an unintended device setting. Which result demonstrates that the intended state was reached?

Restored settings match the approved pre-change configuration after recovery
Per-device execution records show expected command success
Script task history lists only the selected device
Task output identifies the exact failed target and command

Explanation

Correct Answer

The resulting evidence is specific to Post-script revision recovery: restored settings match the approved pre-change configuration after recovery. It demonstrates the requirement to recover after a script created an unintended device setting, rather than merely showing a configuration record was saved.

Incorrect Answers

This result would help verify FortiManager CLI script and its different task to automate a repeatable command change on selected managed devices. It does not establish that the requested Post-script revision recovery outcome has been achieved.

This result would help verify Device-level script target and its different task to avoid applying a chassis-specific command across unrelated firewalls. It does not establish that the requested Post-script revision recovery outcome has been achieved.

This result would help verify Script execution job status and its different task to determine which firewall rejected a command in a multi-device task. It does not establish that the requested Post-script revision recovery outcome has been achieved.

Question 994

The change record says Object reference warning before deletion should prevent accidental removal of an object used by existing access rules. Which result demonstrates that the intended state was reached?

Audit lists low-use rules for security-owner review
Candidate list reports objects without current policy references
No active policy depends on the proposed removal after approved replacement
Validation shows issues or success before Install Wizard executes

Explanation

Correct Answer

The resulting evidence is specific to Object reference warning before deletion: no active policy depends on the proposed removal after approved replacement. It demonstrates the requirement to prevent accidental removal of an object used by existing access rules, rather than merely showing a configuration record was saved.

Incorrect Answers

This result would help verify Find unused policies tool and its different task to identify rules with no observed hits in the available hit-count data. It does not establish that the requested Object reference warning before deletion outcome has been achieved.

This result would help verify Find unused objects tool and its different task to locate objects that are no longer referenced by managed policies. It does not establish that the requested Object reference warning before deletion outcome has been achieved.

This result would help verify Policy check before installation and its different task to detect basic policy consistency issues prior to deploying a package. It does not establish that the requested Object reference warning before deletion outcome has been achieved.

Question 995

Before applying HA member synchronization status for the goal to distinguish a FortiGate member out of sync from an unreachable device, which explicitly described setup step belongs to this control?

Register the intended members as supported model devices with correct identity
Open cluster member details in Device Manager
Verify both FortiGate members run a supported matching firmware version before onboarding
Inspect Device Manager cluster synchronization status

Explanation

Correct Answer

The specific preparation for HA member synchronization status is to inspect Device Manager cluster synchronization status. This addresses the stated need to distinguish a FortiGate member out of sync from an unreachable device, and later acceptance is demonstrated when member appears Synchronized, Out of Sync, or Unknown as appropriate.

Incorrect Answers

That step belongs to HA cluster model device entry, used to prepare cluster inventory before both managed firewalls are online. It is not the mechanism-specific setup for HA member synchronization status required to distinguish a FortiGate member out of sync from an unreachable device.

That step belongs to FortiGate HA member role view, used to determine primary versus secondary members of a centrally managed firewall cluster. It is not the mechanism-specific setup for HA member synchronization status required to distinguish a FortiGate member out of sync from an unreachable device.

That step belongs to HA cluster firmware consistency, used to keep cluster registration from triggering a version conflict. It is not the mechanism-specific setup for HA member synchronization status required to distinguish a FortiGate member out of sync from an unreachable device.

Question 996

The change record says Device database versus ADOM policy database should find why device configuration reports current while an ADOM firewall rule is absent. Which result demonstrates that the intended state was reached?

Discrepancy is attributed to the correct database before choosing retrieve or import
Targeted differences are identified and reconciled through an approved retrieve or install
Selected rollback restores exactly the intended configuration delta
A supported conversion and retrieve reconcile the configuration without unsupported command errors

Explanation

Correct Answer

The resulting evidence is specific to Device database versus ADOM policy database: discrepancy is attributed to the correct database before choosing retrieve or import. It demonstrates the requirement to find why device configuration reports current while an ADOM firewall rule is absent, rather than merely showing a configuration record was saved.

Incorrect Answers

This result would help verify Device database out-of-sync status and its different task to investigate a managed FortiGate whose actual configuration diverged from its FortiManager device database. It does not establish that the requested Device database versus ADOM policy database outcome has been achieved.

This result would help verify Revision rollback selection after incident and its different task to avoid reversing legitimate newer changes while attempting to recover a known good device configuration. It does not establish that the requested Device database versus ADOM policy database outcome has been achieved.

This result would help verify Out-of-sync after firmware or ADOM upgrade and its different task to distinguish a version-conversion issue from a lost FGFM tunnel after a firmware change. It does not establish that the requested Device database versus ADOM policy database outcome has been achieved.

Question 997

The team expects Dynamic address object by installation target to use a common server object name with different local IP addresses for each managed site, but acceptance testing fails. Which diagnostic step best addresses this mechanism?

Investigate a mistakenly shared static address when only some sites lose reachability
Compare the preview to mapping table when one site appears wrong
Inspect missing branch mapping if compiled policy references another site's subnet
Inspect target-specific object mapping if a remote site's address is pushed

Explanation

Correct Answer

This is the focused troubleshooting check for Dynamic address object by installation target: inspect target-specific object mapping if a remote site's address is pushed. It tests the failure most relevant to the goal to use a common server object name with different local IP addresses for each managed site before unrelated settings are changed.

Incorrect Answers

That check is relevant to a fault in Dynamic object versus static address distinction used to decide when different branch sites require different address values under one rule. It does not directly isolate the described Dynamic address object by installation target failure to use a common server object name with different local IP addresses for each managed site.

That check is relevant to a fault in Device-specific object values in policy preview used to verify object resolution before a multi-device deployment. It does not directly isolate the described Dynamic address object by installation target failure to use a common server object name with different local IP addresses for each managed site.

That check is relevant to a fault in Dynamic subnet object for branch networks used to represent a site's LAN with one reusable logical object in a shared package. It does not directly isolate the described Dynamic address object by installation target failure to use a common server object name with different local IP addresses for each managed site.

Question 998

The team configured FortiGuard antivirus and IPS package download for the purpose to maintain locally available AV and IPS update content for managed devices. What verified state indicates success?

Managed FortiGates retrieve supported updates from the intended local manager service
The local package inventory shows expected newer update content
Valid eligible entitlements permit the supported distribution role
Client rating requests are serviced through the configured manager address

Explanation

Correct Answer

The resulting evidence is specific to FortiGuard antivirus and IPS package download: the local package inventory shows expected newer update content. It demonstrates the requirement to maintain locally available AV and IPS update content for managed devices, rather than merely showing a configuration record was saved.

Incorrect Answers

This result would help verify FortiManager local FDS activation and its different task to reduce external update network use for many managed FortiGate devices. It does not establish that the requested FortiGuard antivirus and IPS package download outcome has been achieved.

This result would help verify Local FDS VM subscription eligibility check and its different task to recognize why a trial FortiManager VM cannot function as a paid local FortiGuard distribution server. It does not establish that the requested FortiGuard antivirus and IPS package download outcome has been achieved.

This result would help verify FortiGuard rating-service override and its different task to steer supported FortiGate rating lookups toward a centrally hosted local FortiManager endpoint. It does not establish that the requested FortiGuard antivirus and IPS package download outcome has been achieved.

Question 999

A FortiManager 7.6 administrator needs to prevent a shared settings template from modifying the wrong firewall. Which named management mechanism most directly meets this need?

Template installation target check
Copy system templates across ADOMs
Template provisioning to a model device
Device blueprint for standardized models

Explanation

Correct Answer

Template installation target check fits this operational requirement: prevent a shared settings template from modifying the wrong firewall. The implementation begins by ensuring that administrators review device assignment and install preview for the template-backed change; success is confirmed when only intended target devices show the template settings in the installation operation.

Incorrect Answers

Copy system templates across ADOMs is suited to a different task: reuse an approved baseline without rebuilding it in each management tenant. It does not directly meet the specified goal to prevent a shared settings template from modifying the wrong firewall; selecting it would address a different management function.

Template provisioning to a model device is suited to a different task: prepare network settings before a newly ordered FortiGate is online. It does not directly meet the specified goal to prevent a shared settings template from modifying the wrong firewall; selecting it would address a different management function.

Device blueprint for standardized models is suited to a different task: describe common intended device provisioning settings before enrollment. It does not directly meet the specified goal to prevent a shared settings template from modifying the wrong firewall; selecting it would address a different management function.

Question 1000

For the documented requirement to recognize why a trial FortiManager VM cannot function as a paid local FortiGuard distribution server, the operator proposes Local FDS VM subscription eligibility check. Which installation or setup action belongs to this choice?

Enable the FortiManager built-in FortiGuard Distribution Server and required update services
Verify commercial subscription and support eligibility before planning local FDS service
Enable the supported FortiGuard antivirus and IPS services and synchronize packages from FDN
Configure a reachable FortiGuard override IP and compatible TLS/port binding

Explanation

Correct Answer

The specific preparation for Local FDS VM subscription eligibility check is to verify commercial subscription and support eligibility before planning local FDS service. This addresses the stated need to recognize why a trial FortiManager VM cannot function as a paid local FortiGuard distribution server, and later acceptance is demonstrated when valid eligible entitlements permit the supported distribution role.

Incorrect Answers

That step belongs to FortiManager local FDS activation, used to reduce external update network use for many managed FortiGate devices. It is not the mechanism-specific setup for Local FDS VM subscription eligibility check required to recognize why a trial FortiManager VM cannot function as a paid local FortiGuard distribution server.

That step belongs to FortiGuard antivirus and IPS package download, used to maintain locally available AV and IPS update content for managed devices. It is not the mechanism-specific setup for Local FDS VM subscription eligibility check required to recognize why a trial FortiManager VM cannot function as a paid local FortiGuard distribution server.

That step belongs to FortiGuard rating-service override, used to steer supported FortiGate rating lookups toward a centrally hosted local FortiManager endpoint. It is not the mechanism-specific setup for Local FDS VM subscription eligibility check required to recognize why a trial FortiManager VM cannot function as a paid local FortiGuard distribution server.

Fortinet NSE 5 - FortiManager 7.6 Administrator (FCP_FMG_AD-7.6) Practice Tests

Fortinet FCP_FMG_AD-7.6 Practice Test 98 - 10 Questions (Last Reviewed 26-Sep-2026)
Fortinet FCP_FMG_AD-7.6 Practice Test 99 - 10 Questions (Last Reviewed 25-Sep-2026)
Fortinet FCP_FMG_AD-7.6 Practice Test 100 - 10 Questions (Last Reviewed 24-Sep-2026)

Pass Your Fortinet FCP_FMG_AD-7.6 Exam Easy!

Question 990

Explanation

Correct Answer

Incorrect Answers

Question 991

Explanation

Correct Answer

Incorrect Answers

Question 992

Explanation

Correct Answer

Incorrect Answers

Question 993

Explanation

Correct Answer

Incorrect Answers

Question 994

Explanation

Correct Answer

Incorrect Answers

Question 995

Explanation

Correct Answer

Incorrect Answers

Question 996

Explanation

Correct Answer

Incorrect Answers

Question 997

Explanation

Correct Answer

Incorrect Answers

Question 998

Explanation

Correct Answer

Incorrect Answers

Question 999

Explanation

Correct Answer

Incorrect Answers

Question 1000

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 5 - FortiManager 7.6 Administrator (FCP_FMG_AD-7.6) Practice Tests