Fortinet FCP_FMG_AD-7.6 Practice Test 6

Question 50

Before applying Global package absent at one ADOM for the goal to diagnose why approved shared header policy exists centrally but not at one branch, which explicitly described setup step belongs to this control?

Inspect per-target script logs and command compatibility before retrying only failed devices
Verify global package assignment and target ADOM policy installation sequence
Verify installed policy revision and investigate packet match/interface/routing state on the managed firewall
Compare client override address, routing and entitlement against a known-good FortiGate

Explanation

Correct Answer

The specific preparation for Global package absent at one ADOM is to verify global package assignment and target ADOM policy installation sequence. This addresses the stated need to diagnose why approved shared header policy exists centrally but not at one branch, and later acceptance is demonstrated when the intended ADOM's generated policy includes the shared baseline after approved install.

Incorrect Answers

That step belongs to Script job succeeds on some FortiGates only, used to reconcile mixed CLI script outcomes during a fleet maintenance window. It is not the mechanism-specific setup for Global package absent at one ADOM required to diagnose why approved shared header policy exists centrally but not at one branch.

That step belongs to Central policy install succeeded but traffic still denied, used to distinguish successful FortiManager deployment from a FortiGate runtime match or routing problem. It is not the mechanism-specific setup for Global package absent at one ADOM required to diagnose why approved shared header policy exists centrally but not at one branch.

That step belongs to FortiGuard updates fail for one branch, used to identify a client-specific rating or signature update failure when FortiManager FDS works for other gateways. It is not the mechanism-specific setup for Global package absent at one ADOM required to diagnose why approved shared header policy exists centrally but not at one branch.

Question 51

The change record says Per-policy installation target should deploy a special rule only to a chosen subset within a shared policy package. Which result demonstrates that the intended state was reached?

Status identifies pending or synchronized policy state for selected targets
Install preview and job target list identify only those devices
Only intended target policy views include the exception after install
Fewer aligned packages contain the shared security intent

Explanation

Correct Answer

The resulting evidence is specific to Per-policy installation target: only intended target policy views include the exception after install. It demonstrates the requirement to deploy a special rule only to a chosen subset within a shared policy package, rather than merely showing a configuration record was saved.

Incorrect Answers

This result would help verify Policy package status before rollout and its different task to determine whether edits have been installed to the assigned FortiGates. It does not establish that the requested Per-policy installation target outcome has been achieved.

This result would help verify Policy package installation target and its different task to restrict a change to FortiGates for which it was reviewed. It does not establish that the requested Per-policy installation target outcome has been achieved.

This result would help verify Consolidated package strategy and its different task to reduce repetitive changes for devices with essentially identical access policies. It does not establish that the requested Per-policy installation target outcome has been achieved.

Question 52

An operations responder must restore the FortiGate-initiated secure management tunnel when GUI HTTPS works but device onboarding fails. Which focused troubleshooting workstream best fits the stated failure?

NAT port forwarding to FortiManager
FortiManager hostname mismatch after address change
FGFM session certificate trust troubleshooting
FGFM IPv4 TCP 541 path diagnosis

Explanation

Correct Answer

FGFM IPv4 TCP 541 path diagnosis fits this operational requirement: restore the FortiGate-initiated secure management tunnel when GUI HTTPS works but device onboarding fails. The implementation begins by ensuring that administrators confirm bidirectional TCP 541 reachability toward the actual FortiManager receiving interface; success is confirmed when the FortiGate establishes the management SSL session on its expected protocol endpoint.

Incorrect Answers

NAT port forwarding to FortiManager is suited to a different task: register a FortiGate outside a private manager network when the manager sits behind NAT. It does not directly meet the specified goal to restore the FortiGate-initiated secure management tunnel when GUI HTTPS works but device onboarding fails; selecting it would address a different management function.

FortiManager hostname mismatch after address change is suited to a different task: fix registered FortiGates still trying an obsolete manager destination. It does not directly meet the specified goal to restore the FortiGate-initiated secure management tunnel when GUI HTTPS works but device onboarding fails; selecting it would address a different management function.

FGFM session certificate trust troubleshooting is suited to a different task: distinguish management-protocol trust failure from a reachable TCP socket. It does not directly meet the specified goal to restore the FortiGate-initiated secure management tunnel when GUI HTTPS works but device onboarding fails; selecting it would address a different management function.

Question 53

An administrator states that Installation preview for device changes now allows them to inspect the exact CLI effect of a proposed settings change before rollout. Which check provides the strongest supporting evidence?

The job history shows selected package and device changes applied
Job details show each target success or failure independently
Device installation result reports updated device settings on the target
Preview lists the expected command changes before execution

Explanation

Correct Answer

The resulting evidence is specific to Installation preview for device changes: preview lists the expected command changes before execution. It demonstrates the requirement to inspect the exact CLI effect of a proposed settings change before rollout, rather than merely showing a configuration record was saved.

Incorrect Answers

This result would help verify Install Wizard policy and device selection and its different task to send both a policy package and associated device settings in one controlled deployment. It does not establish that the requested Installation preview for device changes outcome has been achieved.

This result would help verify Per-device installation logs and its different task to identify which managed FortiGate failed part of a multi-target settings push. It does not establish that the requested Installation preview for device changes outcome has been achieved.

This result would help verify Device settings installation and its different task to deploy centrally edited interface or routing settings to a selected managed FortiGate. It does not establish that the requested Installation preview for device changes outcome has been achieved.

Question 54

A managed environment will use Offline model device registration to prepare central policy and device settings for hardware not yet connected. Which preparation check makes the chosen change viable?

Prepare the supported CSV with correct device identifiers and ADOM data
Create a supported offline or model device entry with the intended model and ADOM
Register supported cluster members with compatible firmware and cluster information
Configure the FortiGate manager relationship and authorize the pending request

Explanation

Correct Answer

The specific preparation for Offline model device registration is to create a supported offline or model device entry with the intended model and ADOM. This addresses the stated need to prepare central policy and device settings for hardware not yet connected, and later acceptance is demonstrated when a model record can be prepared before first device communication.

Incorrect Answers

That step belongs to CSV-based offline device onboarding, used to add several preplanned inventory entries without manually clicking every record. It is not the mechanism-specific setup for Offline model device registration required to prepare central policy and device settings for hardware not yet connected.

That step belongs to FortiGate HA cluster device registration, used to manage a FortiGate cluster with both members represented centrally. It is not the mechanism-specific setup for Offline model device registration required to prepare central policy and device settings for hardware not yet connected.

That step belongs to FortiGate-initiated management request, used to approve a firewall that connects to FortiManager seeking central management. It is not the mechanism-specific setup for Offline model device registration required to prepare central policy and device settings for hardware not yet connected.

Question 55

During a branch management project, the primary requirement is to apply syntax and policy objects suitable for managed FortiGate firmware. What is the most appropriate FortiManager control?

Creating a tenant ADOM
ADOM move for a managed device
ADOM upgrade for new feature syntax
ADOM-compatible FortiOS version

Explanation

Correct Answer

ADOM-compatible FortiOS version fits this operational requirement: apply syntax and policy objects suitable for managed FortiGate firmware. The implementation begins by ensuring that administrators select an ADOM version compatible with the target FortiOS release; success is confirmed when policy and device configuration screens expose compatible features.

Incorrect Answers

Creating a tenant ADOM is suited to a different task: allocate a dedicated policy and device-management context to a new organization. It does not directly meet the specified goal to apply syntax and policy objects suitable for managed FortiGate firmware; selecting it would address a different management function.

ADOM move for a managed device is suited to a different task: transfer a FortiGate to a different management tenant with scoped policies. It does not directly meet the specified goal to apply syntax and policy objects suitable for managed FortiGate firmware; selecting it would address a different management function.

ADOM upgrade for new feature syntax is suited to a different task: adopt policy-object capabilities of a newer supported ADOM version. It does not directly meet the specified goal to apply syntax and policy objects suitable for managed FortiGate firmware; selecting it would address a different management function.

Question 56

An administrator reports success using Revision Diff between device snapshots to isolate a configuration line introduced during an incident. Which control-specific limitation still applies?

Revision history is device-specific and distinct from ADOM policy database revisions
A revision diff is a comparison, not a device configuration installation
Retained revisions are not equivalent to an off-appliance disaster-recovery backup
Retrieval does not automatically make an ADOM policy package match the device

Explanation

Correct Answer

The stated scope boundary specifically qualifies Revision Diff between device snapshots: a revision diff is a comparison, not a device configuration installation. The control is appropriate for the operational need to isolate a configuration line introduced during an incident, but should not be credited with unrelated behavior.

Incorrect Answers

That caveat describes FortiGate revision history view in a different management scenario, which addresses inspect how a managed device configuration changed between approved dates. It is not the specific limitation of Revision Diff between device snapshots requested in this design review.

That caveat describes Automatic device revision collection in a different management scenario, which addresses retain device configuration history around central management operations. It is not the specific limitation of Revision Diff between device snapshots requested in this design review.

That caveat describes Retrieve current FortiGate configuration in a different management scenario, which addresses align FortiManager's device database with a change performed locally on the FortiGate. It is not the specific limitation of Revision Diff between device snapshots requested in this design review.

Question 57

An administrator will use Interface-mapping changes and revision control to preserve a tested site's port mapping through a centralized policy update. Before sign-off, which setup step must be completed for that approach?

Capture the mapping in ADOM change control and install preview
Define a normalized interface and map it to each target's actual interface
Review all target mapping completeness before installation
Set each target's interface mapping to the locally connected port

Explanation

Correct Answer

The specific preparation for Interface-mapping changes and revision control is to capture the mapping in ADOM change control and install preview. This addresses the stated need to preserve a tested site's port mapping through a centralized policy update, and later acceptance is demonstrated when reviewed revision shows the site's old and new interface targets.

Incorrect Answers

That step belongs to Normalized interface for shared policy, used to use one logical interface name across FortiGates with different physical port names. It is not the mechanism-specific setup for Interface-mapping changes and revision control required to preserve a tested site's port mapping through a centralized policy update.

That step belongs to Normalized interface missing-map alert, used to identify an install failure caused by an unmapped policy interface. It is not the mechanism-specific setup for Interface-mapping changes and revision control required to preserve a tested site's port mapping through a centralized policy update.

That step belongs to Per-device interface mapping, used to install common rules across sites whose WAN links use different physical ports. It is not the mechanism-specific setup for Interface-mapping changes and revision control required to preserve a tested site's port mapping through a centralized policy update.

Question 58

An operator must choose the correct management plane for security rules rather than signature service updates. Which option directly addresses this FortiManager administration task?

Global package change impact review
Global policy header and footer ordering
Global object availability for ADOM policy
Global policy versus FortiGuard configuration

Explanation

Correct Answer

Global policy versus FortiGuard configuration fits this operational requirement: choose the correct management plane for security rules rather than signature service updates. The implementation begins by ensuring that administrators manage organization-wide firewall policies in the global policy database while maintaining signatures in FortiGuard settings; success is confirmed when shared policy installation and update-package synchronization remain separately observable.

Incorrect Answers

Global package change impact review is suited to a different task: prevent one shared policy edit from silently affecting unrelated managed sites. It does not directly meet the specified goal to choose the correct management plane for security rules rather than signature service updates; selecting it would address a different management function.

Global policy header and footer ordering is suited to a different task: guarantee that common security controls occupy a predetermined position around local rules. It does not directly meet the specified goal to choose the correct management plane for security rules rather than signature service updates; selecting it would address a different management function.

Global object availability for ADOM policy is suited to a different task: reuse controlled organization-wide object definitions across assigned ADOMs. It does not directly meet the specified goal to choose the correct management plane for security rules rather than signature service updates; selecting it would address a different management function.

Question 59

An administrator states that Backup certificate as HA exception now allows them to avoid assuming a local administrator authentication certificate is copied with every HA database update. Which check provides the strongest supporting evidence?

Each peer independently reports an accurate time and audit sequence
Each HA member remains reachable at its own approved network address
Update availability is verified on the standby rather than inferred from a primary's package count
Secure administration works against both primary and standby endpoints

Explanation

Correct Answer

The resulting evidence is specific to Backup certificate as HA exception: secure administration works against both primary and standby endpoints. It demonstrates the requirement to avoid assuming a local administrator authentication certificate is copied with every HA database update, rather than merely showing a configuration record was saved.

Incorrect Answers

This result would help verify Backup time and NTP independence and its different task to keep peer log timestamps consistent although local time configuration is not fully synchronized. It does not establish that the requested Backup certificate as HA exception outcome has been achieved.

This result would help verify Per-node HA management network configuration and its different task to prepare a standby with a distinct management IP for reachable failover operations. It does not establish that the requested Backup certificate as HA exception outcome has been achieved.

This result would help verify FortiGuard database synchronization exception and its different task to ensure the backup can supply required FortiGuard services after manager HA failover. It does not establish that the requested Backup certificate as HA exception outcome has been achieved.

Question 60

An operations responder must keep management stable when the firewall cluster elects a different active member. Which focused troubleshooting workstream best fits the stated failure?

FortiManager HA peer heartbeat loss
FGFM keepalive failure to registered FortiGate
FortiGate HA role swap versus FortiManager device inventory
HA pending module data after policy edit

Explanation

Correct Answer

FortiGate HA role swap versus FortiManager device inventory fits this operational requirement: keep management stable when the firewall cluster elects a different active member. The implementation begins by ensuring that administrators verify the cluster's current primary member and management protocol mapping in FortiManager; success is confirmed when central inventory reflects healthy cluster state after FortiGate role change.

Incorrect Answers

FortiManager HA peer heartbeat loss is suited to a different task: isolate a manager backup marked Down even while the primary GUI is healthy. It does not directly meet the specified goal to keep management stable when the firewall cluster elects a different active member; selecting it would address a different management function.

FGFM keepalive failure to registered FortiGate is suited to a different task: diagnose a device marked disconnected after previously successful secure registration. It does not directly meet the specified goal to keep management stable when the firewall cluster elects a different active member; selecting it would address a different management function.

HA pending module data after policy edit is suited to a different task: investigate a secondary FortiManager that displays old central policy after a primary-side update. It does not directly meet the specified goal to keep management stable when the firewall cluster elects a different active member; selecting it would address a different management function.

Fortinet NSE 5 - FortiManager 7.6 Administrator (FCP_FMG_AD-7.6) Practice Tests

Fortinet FCP_FMG_AD-7.6 Practice Test 4 - 10 Questions (Last Reviewed 02-Nov-2026)
Fortinet FCP_FMG_AD-7.6 Practice Test 5 - 10 Questions (Last Reviewed 01-Nov-2026)
Fortinet FCP_FMG_AD-7.6 Practice Test 6 - 10 Questions (Last Reviewed 31-Oct-2026)
Fortinet FCP_FMG_AD-7.6 Practice Test 7 - 10 Questions (Last Reviewed 30-Oct-2026)
Fortinet FCP_FMG_AD-7.6 Practice Test 8 - 10 Questions (Last Reviewed 29-Oct-2026)

Pass Your Fortinet FCP_FMG_AD-7.6 Exam Easy!

Question 50

Explanation

Correct Answer

Incorrect Answers

Question 51

Explanation

Correct Answer

Incorrect Answers

Question 52

Explanation

Correct Answer

Incorrect Answers

Question 53

Explanation

Correct Answer

Incorrect Answers

Question 54

Explanation

Correct Answer

Incorrect Answers

Question 55

Explanation

Correct Answer

Incorrect Answers

Question 56

Explanation

Correct Answer

Incorrect Answers

Question 57

Explanation

Correct Answer

Incorrect Answers

Question 58

Explanation

Correct Answer

Incorrect Answers

Question 59

Explanation

Correct Answer

Incorrect Answers

Question 60

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 5 - FortiManager 7.6 Administrator (FCP_FMG_AD-7.6) Practice Tests