Fortinet FCP_FMG_AD-7.6 Practice Test 49

Question 480

After deploying Name collision between device and ADOM object to preserve correct match semantics when a FortiGate object name already exists centrally with different value, a reviewer requests operational evidence. Which result best satisfies the acceptance criterion?

Supported rules import and unsupported features are separately documented for remediation
Every required approved rule is accounted for before final signoff
Imported policy rules resolve to the approved address or service value
Import report no longer flags missing object references for selected rules

Explanation

Correct Answer

The resulting evidence is specific to Name collision between device and ADOM object: imported policy rules resolve to the approved address or service value. It demonstrates the requirement to preserve correct match semantics when a FortiGate object name already exists centrally with different value, rather than merely showing a configuration record was saved.

Incorrect Answers

This result would help verify Unsupported feature during import and its different task to avoid losing source-device policy behavior when the target ADOM does not support its feature. It does not establish that the requested Name collision between device and ADOM object outcome has been achieved.

This result would help verify Import wizard completion versus per-object failures and its different task to identify why a completed import dialog still leaves missing rules in the central package. It does not establish that the requested Name collision between device and ADOM object outcome has been achieved.

This result would help verify Missing source object on policy import and its different task to recover an import stopped by a reference to an undefined address or service. It does not establish that the requested Name collision between device and ADOM object outcome has been achieved.

Question 481

The team configured Session cleanup after failed editor disconnect for the purpose to recover a policy package from a stale writer lock safely. What verified state indicates success?

That rule is exclusive while other unlocked policy items remain available
Only package lock owner can change that package until release
Authorized editor can acquire the package without lost approved changes
Submitted session appears awaiting or receiving the required approval

Explanation

Correct Answer

The resulting evidence is specific to Session cleanup after failed editor disconnect: authorized editor can acquire the package without lost approved changes. It demonstrates the requirement to recover a policy package from a stale writer lock safely, rather than merely showing a configuration record was saved.

Incorrect Answers

This result would help verify Workspace-mode individual policy lock and its different task to prevent simultaneous edits to one sensitive rule while another rule can be edited. It does not establish that the requested Session cleanup after failed editor disconnect outcome has been achieved.

This result would help verify Workspace-mode per-package lock and its different task to let an administrator edit one package without blocking colleagues on unrelated packages. It does not establish that the requested Session cleanup after failed editor disconnect outcome has been achieved.

This result would help verify Workflow session submission and its different task to route a prepared policy change to a designated approval group. It does not establish that the requested Session cleanup after failed editor disconnect outcome has been achieved.

Question 482

An administrator reports success using FortiManager HA heartbeat state to determine whether the HA backup has lost contact with the primary. Which control-specific limitation still applies?

Automatic manager failover must not be confused with failover of FortiGate firewall sessions
A peer appearing in configuration is not proof it is presently reachable
Synchronized policy data does not mean local network and HA settings are identical
FortiManager HA protects the management service and is not FortiGate dataplane HA

Explanation

Correct Answer

The stated scope boundary specifically qualifies FortiManager HA heartbeat state: a peer appearing in configuration is not proof it is presently reachable. The control is appropriate for the operational need to determine whether the HA backup has lost contact with the primary, but should not be credited with unrelated behavior.

Incorrect Answers

That caveat describes FortiManager automatic HA failover mode in a different management scenario, which addresses use the supported automatic VRRP-based failover behavior rather than a manual promotion process. It is not the specific limitation of FortiManager HA heartbeat state requested in this design review.

That caveat describes FortiManager HA synchronization counters in a different management scenario, which addresses prove central policy data replication before depending on a standby for recovery. It is not the specific limitation of FortiManager HA heartbeat state requested in this design review.

That caveat describes FortiManager primary and secondary roles in a different management scenario, which addresses provide a recoverable manager control plane using a primary appliance and backup units. It is not the specific limitation of FortiManager HA heartbeat state requested in this design review.

Question 483

The team configured Individual policy-package lock for the purpose to let administrators safely edit different packages within one ADOM. What verified state indicates success?

Another authorized admin can acquire the released package lock
One package is editable to its holder while another remains available independently
Edits are permitted for the lock owner and unavailable to other administrators
Session status records submitted changes and the approving actor

Explanation

Correct Answer

The resulting evidence is specific to Individual policy-package lock: one package is editable to its holder while another remains available independently. It demonstrates the requirement to let administrators safely edit different packages within one ADOM, rather than merely showing a configuration record was saved.

Incorrect Answers

This result would help verify Policy-package editing after lock release and its different task to restore safe concurrent editing following an approved workspace change. It does not establish that the requested Individual policy-package lock outcome has been achieved.

This result would help verify ADOM workspace lock and its different task to prevent conflicting concurrent changes across a shared ADOM during an approved change. It does not establish that the requested Individual policy-package lock outcome has been achieved.

This result would help verify Workflow change session and its different task to require submitted approval before a policy change moves through team controls. It does not establish that the requested Individual policy-package lock outcome has been achieved.

Question 484

After deploying Workspace stale lock blocks emergency change to restore safe edit rights after a disconnected administrator retains a package lock, a reviewer requests operational evidence. Which result best satisfies the acceptance criterion?

Failed members report corrected supported command execution while healthy members remain unchanged
Traffic decision matches intended rule and network path after targeted diagnosis
An authorized operator acquires the specific package and can complete the intended change
The affected gateway receives the intended update package after its override is fixed

Explanation

Correct Answer

The resulting evidence is specific to Workspace stale lock blocks emergency change: an authorized operator acquires the specific package and can complete the intended change. It demonstrates the requirement to restore safe edit rights after a disconnected administrator retains a package lock, rather than merely showing a configuration record was saved.

Incorrect Answers

This result would help verify Script job succeeds on some FortiGates only and its different task to reconcile mixed CLI script outcomes during a fleet maintenance window. It does not establish that the requested Workspace stale lock blocks emergency change outcome has been achieved.

This result would help verify Central policy install succeeded but traffic still denied and its different task to distinguish successful FortiManager deployment from a FortiGate runtime match or routing problem. It does not establish that the requested Workspace stale lock blocks emergency change outcome has been achieved.

This result would help verify FortiGuard updates fail for one branch and its different task to identify a client-specific rating or signature update failure when FortiManager FDS works for other gateways. It does not establish that the requested Workspace stale lock blocks emergency change outcome has been achieved.

Question 485

While assessing Dedicated FortiGuard service binding for the requirement to supply update or rating access on an explicitly configured manager interface, which documented limitation should the reviewer remember?

DNS settings do not by themselves allow firewall policy installation to FortiGate
Accurate time is not a replacement for retaining configuration revisions
A management IP configuration is not a per-device FortiGate interface template
This binding affects local FortiGuard distribution, not the FortiManager administrative GUI login

Explanation

Correct Answer

The stated scope boundary specifically qualifies Dedicated FortiGuard service binding: this binding affects local FortiGuard distribution, not the FortiManager administrative GUI login. The control is appropriate for the operational need to supply update or rating access on an explicitly configured manager interface, but should not be credited with unrelated behavior.

Incorrect Answers

That caveat describes Management DNS resolver settings in a different management scenario, which addresses resolve approved FortiGuard and infrastructure hostnames from the manager. It is not the specific limitation of Dedicated FortiGuard service binding requested in this design review.

That caveat describes NTP clock synchronization for manager logs in a different management scenario, which addresses align FortiManager audit timestamps and certificate-sensitive connections. It is not the specific limitation of Dedicated FortiGuard service binding requested in this design review.

That caveat describes Management interface address assignment in a different management scenario, which addresses place FortiManager management connectivity on the approved subnet. It is not the specific limitation of Dedicated FortiGuard service binding requested in this design review.

Question 486

For the documented requirement to prevent conflicting concurrent changes across a shared ADOM during an approved change, the operator proposes ADOM workspace lock. Which installation or setup action belongs to this choice?

Enable workspace and obtain the lock before editing ADOM-wide settings
Use workspace mode and lock the specific policy package
Inspect active administrator sessions and their locked elements
Save or discard pending edits before unlocking the package

Explanation

Correct Answer

The specific preparation for ADOM workspace lock is to enable workspace and obtain the lock before editing ADOM-wide settings. This addresses the stated need to prevent conflicting concurrent changes across a shared ADOM during an approved change, and later acceptance is demonstrated when edits are permitted for the lock owner and unavailable to other administrators.

Incorrect Answers

That step belongs to Individual policy-package lock, used to let administrators safely edit different packages within one ADOM. It is not the mechanism-specific setup for ADOM workspace lock required to prevent conflicting concurrent changes across a shared ADOM during an approved change.

That step belongs to Session and lock ownership monitoring, used to identify which operator prevents an urgent ADOM edit. It is not the mechanism-specific setup for ADOM workspace lock required to prevent conflicting concurrent changes across a shared ADOM during an approved change.

That step belongs to Policy-package editing after lock release, used to restore safe concurrent editing following an approved workspace change. It is not the mechanism-specific setup for ADOM workspace lock required to prevent conflicting concurrent changes across a shared ADOM during an approved change.

Question 487

An administrator will use Device authorization profile scope to restrict who can register a FortiGate in a customer ADOM. Before sign-off, which setup step must be completed for that approach?

Grant enrollment permissions only to the assigned administrator profile and tenant
Check manager-to-device IP path, required protocol, and credentials before import
Configure reachable management endpoints and allow the FGFM management path
Verify identity and authorize the pending FortiGate in the intended ADOM

Explanation

Correct Answer

The specific preparation for Device authorization profile scope is to grant enrollment permissions only to the assigned administrator profile and tenant. This addresses the stated need to restrict who can register a FortiGate in a customer ADOM, and later acceptance is demonstrated when unauthorized administrator cannot approve the pending device.

Incorrect Answers

That step belongs to Device discovery reachability test, used to distinguish a network problem from a policy import failure during enrollment. It is not the mechanism-specific setup for Device authorization profile scope required to restrict who can register a FortiGate in a customer ADOM.

That step belongs to FGFM management channel, used to support persistent FortiGate-to-FortiManager management communication. It is not the mechanism-specific setup for Device authorization profile scope required to restrict who can register a FortiGate in a customer ADOM.

That step belongs to Pending FortiGate authorization approval, used to prevent unknown devices from entering the managed inventory without review. It is not the mechanism-specific setup for Device authorization profile scope required to restrict who can register a FortiGate in a customer ADOM.

Question 488

A FortiManager team implemented FortiManager HA synchronization counters to prove central policy data replication before depending on a standby for recovery. Which observed outcome most directly proves the change works?

Synchronized module data is current and unexpected pending data reaches zero
HA role transfer occurs under the designated failure test without manual secondary promotion
The promoted appliance advertises Primary role and managed communication resumes
The HA status page shows the intended primary and secondary units as cluster members

Explanation

Correct Answer

The resulting evidence is specific to FortiManager HA synchronization counters: synchronized module data is current and unexpected pending data reaches zero. It demonstrates the requirement to prove central policy data replication before depending on a standby for recovery, rather than merely showing a configuration record was saved.

Incorrect Answers

This result would help verify FortiManager automatic HA failover mode and its different task to use the supported automatic VRRP-based failover behavior rather than a manual promotion process. It does not establish that the requested FortiManager HA synchronization counters outcome has been achieved.

This result would help verify FortiManager manual HA takeover and its different task to recover manager operations after primary failure where manual failover is configured. It does not establish that the requested FortiManager HA synchronization counters outcome has been achieved.

This result would help verify FortiManager primary and secondary roles and its different task to provide a recoverable manager control plane using a primary appliance and backup units. It does not establish that the requested FortiManager HA synchronization counters outcome has been achieved.

Question 489

The team chose FortiManager local FDS activation for the purpose to reduce external update network use for many managed FortiGate devices. Which boundary on this control must remain explicit in the design?

FortiManager acting as FDS is different from serving central firewall policy installation
Offline mode cannot fetch new signatures from the Internet by itself
Rating-service override does not change the administrative HTTPS login URL automatically
Enabling service alone does not prove current signatures are downloaded

Explanation

Correct Answer

The stated scope boundary specifically qualifies FortiManager local FDS activation: FortiManager acting as FDS is different from serving central firewall policy installation. The control is appropriate for the operational need to reduce external update network use for many managed FortiGate devices, but should not be credited with unrelated behavior.

Incorrect Answers

That caveat describes Closed-network FDS package import in a different management scenario, which addresses keep a supported isolated FortiManager update environment functional without direct Internet FDN connectivity. It is not the specific limitation of FortiManager local FDS activation requested in this design review.

That caveat describes FortiGuard rating-service override in a different management scenario, which addresses steer supported FortiGate rating lookups toward a centrally hosted local FortiManager endpoint. It is not the specific limitation of FortiManager local FDS activation requested in this design review.

That caveat describes FortiGuard antivirus and IPS package download in a different management scenario, which addresses maintain locally available AV and IPS update content for managed devices. It is not the specific limitation of FortiManager local FDS activation requested in this design review.

Question 490

A FortiManager incident involves FortiManager HA heartbeat state: the team cannot determine whether the HA backup has lost contact with the primary. What targeted troubleshooting check is appropriate?

Check peer identity, reachability and HA settings when a backup does not join
Inspect VRRP mode and routing reachability when takeover requires intervention
Investigate suspended sync or an unreachable peer when pending module data persists
Check the HA path and peer connectivity when the cluster state is Down

Explanation

Correct Answer

This is the focused troubleshooting check for FortiManager HA heartbeat state: check the HA path and peer connectivity when the cluster state is Down. It tests the failure most relevant to the goal to determine whether the HA backup has lost contact with the primary before unrelated settings are changed.

Incorrect Answers

That check is relevant to a fault in FortiManager primary and secondary roles used to provide a recoverable manager control plane using a primary appliance and backup units. It does not directly isolate the described FortiManager HA heartbeat state failure to determine whether the HA backup has lost contact with the primary.

That check is relevant to a fault in FortiManager automatic HA failover mode used to use the supported automatic VRRP-based failover behavior rather than a manual promotion process. It does not directly isolate the described FortiManager HA heartbeat state failure to determine whether the HA backup has lost contact with the primary.

That check is relevant to a fault in FortiManager HA synchronization counters used to prove central policy data replication before depending on a standby for recovery. It does not directly isolate the described FortiManager HA heartbeat state failure to determine whether the HA backup has lost contact with the primary.

Fortinet NSE 5 - FortiManager 7.6 Administrator (FCP_FMG_AD-7.6) Practice Tests

Fortinet FCP_FMG_AD-7.6 Practice Test 47 - 10 Questions (Last Reviewed 20-Sep-2026)
Fortinet FCP_FMG_AD-7.6 Practice Test 48 - 10 Questions (Last Reviewed 19-Sep-2026)
Fortinet FCP_FMG_AD-7.6 Practice Test 49 - 10 Questions (Last Reviewed 18-Sep-2026)
Fortinet FCP_FMG_AD-7.6 Practice Test 50 - 10 Questions (Last Reviewed 17-Sep-2026)
Fortinet FCP_FMG_AD-7.6 Practice Test 51 - 10 Questions (Last Reviewed 16-Sep-2026)

Pass Your Fortinet FCP_FMG_AD-7.6 Exam Easy!

Question 480

Explanation

Correct Answer

Incorrect Answers

Question 481

Explanation

Correct Answer

Incorrect Answers

Question 482

Explanation

Correct Answer

Incorrect Answers

Question 483

Explanation

Correct Answer

Incorrect Answers

Question 484

Explanation

Correct Answer

Incorrect Answers

Question 485

Explanation

Correct Answer

Incorrect Answers

Question 486

Explanation

Correct Answer

Incorrect Answers

Question 487

Explanation

Correct Answer

Incorrect Answers

Question 488

Explanation

Correct Answer

Incorrect Answers

Question 489

Explanation

Correct Answer

Incorrect Answers

Question 490

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 5 - FortiManager 7.6 Administrator (FCP_FMG_AD-7.6) Practice Tests