Accurate Hot Selling FCP_FMG_AD-7.6 Exam Dumps 2026 Newly Released
Get 100% Authentic Fortinet FCP_FMG_AD-7.6 Dumps with Correct Answers
Fortinet FCP_FMG_AD-7.6 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 33
Refer to the exhibit. How does FortiManager get antivirus and IPS updates?
- A. It gets updates from the server with IP address 10.0.1.50.
- B. It uses all URLs in the list that contain the fds host name.
- C. It connects to all servers marked as FortiGuard Distribution Network through Internet (FDNI) sources.
- D. It connects to the public FortiGuard servers listed in the configuration.
Answer: A
Explanation:
The output shows that Server Override Mode is set to Strict, and the server at index 0 (IP
10.0.1.50, port 8890) is marked with an asterisk *, indicating it is the active FortiGuard server.
Since it was configured via CLI and is at the top of the list, FortiManager will exclusively use this server for antivirus and IPS updates.
NEW QUESTION # 34
An administrator has a FortiGate-HQ device with VDOMs--root, HR and Facilities, currently managed under the FortiManager ADOM--Site1. They try to move VDOM HR to the FortiManager ADOM-- Site2, but it does not work.
Why is the administrator not able to move FortiGate-HQ VDOM HR to FortiManager ADOM-- Site2?
- A. The administrator must delete the FortiGate-HQ device from FortiManager and add it again using the Add Device wizard before moving the VDOM.
- B. The administrator must have full access in the device layer of FortiGate-HQ VDOM-root before they can VDOMs to different ADOMs.
- C. FortiManager must be in ADOM normal mode, which does not allow VDOMs to be managed separately.
- D. The FortiGate-HQ must be managed under the FortiManager ADOM--root to allow moving its VDOMs to different ADOMs.
Answer: C
Explanation:
An ADOM can work in device moces: Normal, which is the default mode, and Advanced.
In Normal mode, you cannot assign diferent FortiGate virtual domains (VDOMs) to different Fortitvlanager ADOMs.
In Advanced mode, you can assign different VDOMs from the sarne FortjGate device to diferent ADOMs. The system applies this setting globally to all ADOMs. This resutts in more complex management scenarios, and it is recommended for advanced users only.
NEW QUESTION # 35
Refer to the exhibit. What can you conclude from the downloaded import report?
- A. FortiManager will change the configuration of REMOTE_SUBNET to match the interface mapping coming in from Remote-FortiGate.
- B. As a result of this policy import process, FortiManager will create a new firewall address called REMOTE_SUBNET in the ADOM database.
- C. The administrator will see a new policy package named Remote-FortiGate_root in the FortiManager ADOM database.
- D. FortiManager does not support per-device mapping for firewall addresses.
Answer: C
Explanation:
The import report shows that a new policy package named Remote-FortiGate_root will be created in the FortiManager ADOM database, but some firewall addresses and policies failed to import due to interface binding conflicts.
NEW QUESTION # 36
An administrator has assigned a global policy package to a new ADOM named ADOM1.
What will happen if the administrator tries to create a new policy package in ADOM1?
- A. FortiManager will automatically assign the global policy package to the new policy package.
- B. The administrator will have to assign the global policy package from the global ADOM.
- C. The administrator will be able to select the option to assign the global policy package to the new policy package.
- D. FortiManager will automatically install policies on the policy package in ADOM1.
Answer: C
Explanation:
When a global policy package is assigned to an ADOM, administrators creating new policy packages within that ADOM have the option to select and assign the global policy package to the new policy package if desired.
NEW QUESTION # 37
An administrator has enabled Service Access on FortiManager. What is the purpose of Service Access on the FortiManager interface?
- A. It allows FortiManager to respond to requests for FortiGuard services from FortiGate devices.
- B. It allows administrative access to FortiManager.
- C. It allows FortiManager to determine the connection status of managed devices.
- D. It allows third-party applications to gain read/write access to FortiManager.
Answer: A
Explanation:
Select the Fortinet services that are allowed access on this interface. These include FortiGate Updates and Web Filtering. Service access is not enabled on any port by default.
NEW QUESTION # 38
If one of the secondary FortiManager devices fails, which action must be performed to return the FortiManager HA manual mode to a working state?
- A. Remove the peer IP of the failed device on the primary device.
- B. The FortiManager high availability (HA) state transition is transparent to administrators and does not require any reconfiguration.
- C. Run a sanity check on the failed device to make sure HA heartbeat packets are using TCP port
5199. - D. Manually promote one of the working secondary devices to the primary role.
Answer: A
Explanation:
If a secondary fails, there is no change. Primary remains the same. Admin must remove the IP of the secondary. if you remove a secondary member from the HA configuration, the primary FortiManager removes the secondary serial number from the central management configuration of FortiGate, and updates the managed FortiGate devices immediately.
NEW QUESTION # 39
Refer to the exhibits.
An administrator needs to push a FortiToken Mobile to assign it to HR_user in the HQ-NGFW-1.
However, when installing the policy package, they receive the following error message:
Why is the administratornotable to install the FortiToken on the HQ-NGFW-1 firewall?
- A. The administrator must use a valid FortiToken that exists on HQ-NGFW-1.
- B. The administrator must use per-device mapping to assign the FortiToken to HQ-NGFW-1.
- C. The administrator must use a user local meta field to assign FortiToken.
- D. The administrator must use a metadata variable to assign the same FortiToken to multiple users in FortiManager.
Answer: A
Explanation:
The error occurs because the FortiToken used (FTKM0B4A9AC5C56D) must already exist and be registered on the FortiGate device HQ-NGFW-1. FortiManager cannot push or create new FortiTokens on the device; the token must be valid and present on the FortiGate before it can be assigned to a user.
NEW QUESTION # 40
An administrator has assigned a global policy package to a new ADOM named ADOM1. What will happen if the administrator tries to create a new policy package in ADOM1?
- A. The administrator will be able to select the option to assign the global policy package to the new policy package.
- B. FortiManager will automatically assign the global policy package to the new policy package.
- C. The administrator will have to assign the global policy package from the global ADOM.
- D. FortiManager will automatically install policies on the policy package in ADOM1.
Answer: B
Explanation:
In FortiManager, when a global policy package is assigned to an ADOM, any new policy package created within that ADOM will automatically inherit and include the assigned global policy package. This is designed to ensure consistency and centralized control over shared policies across multiple ADOMs.
NEW QUESTION # 41
Refer to the exhibit.
Which two statements about the output are true? (Choose two.)
- A. The latest revision history for the managed FortiGate does not match the device-level database.
- B. The latest revision history for the managed FortiGate does match the FortiManager policy database.
- C. The system template default will override device-level database configurations.
- D. Configuration changes have been installed on FortiGate, updating policy and device-level database.
Answer: A,C
Explanation:
The status "pending" indicates the latest revision history does not match the device-level database, meaning there are unapplied changes.
The template is marked as [modified], so the system template default will override device-level database configurations when installed.
NEW QUESTION # 42
Push updates are failing on a FortiGate device located behind a network address translation (NAT) device?
Which two settings should the administrator check to correct this problem? (Choose two.)
- A. Make sure the Bind to IP address option on the FortiGuard service interface is set to the virtual IP address from the NAT device.
- B. Make sure the virtual IP address and the correct ports are configured on the NAT device.
- C. Make sure the NAT device IP address and the correct ports are configured on FortiManager.
- D. Make sure FortiGuard updates and web service are enabled on the FortiGuard service interface.
Answer: B,C
Explanation:
FortiManager must have the NAT device's IP address and correct ports configured to communicate properly with the FortiGate behind NAT.
The NAT device must have the correct virtual IP address and ports configured to allow push updates to reach the FortiGate device.
NEW QUESTION # 43
Refer to the exhibits.
An administrator needs to push a FortiToken Mobile to assign it to HR_user in the HQ-NGFW-1.
However, when installing the policy package, they receive the following error message:
Why is the administrator not able to install the FortiToken on the HQ-NGFW-1 firewall?
- A. The administrator must use a valid FortiToken that exists on HQ-NGFW-1.
- B. The administrator must use per-device mapping to assign the FortiToken to HQ-NGFW-1.
- C. The administrator must use a user local meta field to assign FortiToken.
- D. The administrator must use a metadata variable to assign the same FortiToken to multiple users in FortiManager.
Answer: A
Explanation:
The error occurs because the FortiToken used (FTKM0B4A9AC5C56D) must already exist and be registered on the FortiGate device HQ-NGFW-1. FortiManager cannot push or create new FortiTokens on the device; the token must be valid and present on the FortiGate before it can be assigned to a user.
NEW QUESTION # 44
Which two items does an FGFM keepalive message include? (Choose two.)
- A. FortiGate uptime
- B. FortiGate IPS version
- C. FortiGate license information
- D. FortiGate configuration checksum
Answer: B,D
Explanation:
Keepalive messages, including the configuration checksums, are sent from FortiGate at configured intervals.
The messages also show the intrusion prevention system (IPS) version of the FortiGate device.
NEW QUESTION # 45
Refer to the exhibits.
FortiGate HQ-NGFW-1 downloads and validates FortiGuard databases from FortiManager which acts as a local FortiGuard Distribution Server (FDS) in a closed network. An administrator pushes a new firewall policy with an intrusion prevention system (IPS) profile from FortiManager to FortiGate HQ- NGFW-1 However, FortiGate does not recognize the new IPS signature from FortiManager.
What is the most likely reason why FortiGate HQ-NGFW-1 does not recognize the new IPS signature?
- A. The administrator must enable IPv6 connections for FortiGuard services on FortiManager.
- B. The administrator must enable the fortiguard-anycast option to correctly download all signatures from the local FDS.
- C. FortiGate must enable rating for the FortiManager IP address, 192.168.1.120, in server list 1.
- D. FortiManager and FortiGate have different IPS database versions.
Answer: D
Explanation:
The most likely reason FortiGate HQ-NGFW-1 does not recognize the new IPS signature is that FortiManager and FortiGate have different IPS database versions. The FortiManager may have pushed a signature update that FortiGate has not yet synchronized or validated locally, causing the signature to be unrecognized.
NEW QUESTION # 46
A service provider administrator has assigned a global policy package to a managed customer ADOM named My_ADOM. The customer administrator has access only to My_ADOM.
How can the customer administrator edit the global header policy of the global policy package?
- A. The customer administrator can edit the header policy by using workspace mode on the global ADOM.
- B. The customer administrator cannot edit the global header policy; only the service provider administrator can make changes from the global ADOM.
- C. The customer administrator can edit the header policy by using workflow mode on the global ADOM and My_ADOM.
- D. The service provider administrator can unlock the global policy from the global ADOM to authorize changes to the customer administrator.
Answer: B
Explanation:
The global policy package is managed only from the global ADOM by the service provider administrator.
Customer administrators with access solely to their ADOM (My_ADOM) cannot edit the global header policy; such changes must be made by the service provider administrator in the global ADOM.
NEW QUESTION # 47
An administrator configures a new BGP peer in the FortiManager device-level database of FortiGate. They reinstall the policy package to the managed FortiGate device without any errors. However, when the administrator logs in to FortiGate, they do not see the BGP configuration changes.
What is the most likely reason why FortiManager did not push the BGP peer changes to FortiGate?
- A. The administrator must use the Install Wizard and select Install device settings only to push BGP settings
- B. The administrator must run a sanity check on FortiManager to make sure the database is not corrupted.
- C. The FortiGate firmware version is different from the FortiManager ADOM version.
- D. Fortigate has a BGP template assigned on the FortiManager database.
Answer: D
Explanation:
If a BGP template is assigned to the FortiGate device on FortiManager, device-level BGP configurations made directly in the device-level database are overridden by the template settings, so the changes do not get pushed to the device.
NEW QUESTION # 48
Refer to the exhibits. An administrator must replace the source LAN interface in policy ID 2 on their FortiGateRugged-70F.
However, when they try to install the policy package, they receive the error shown in the exhibit.
What should the administrator do to resolve the error?
- A. Use the API to assign a system template interface forFortiGateRugged-70F model.
- B. Replace LAN with lan1, which is supported by FortiGateRugged-70F models.
- C. Use a metadata variable to dynamically assign an interface when this error occurs.
- D. Create a per0device mapping for the LAN interface.
Answer: D
Explanation:
The installation error clearly states that the dynamic interface mapping for "LAN" is undefined for device HQ-NGFW-1 (a FortiGateRugged-70F). In the "Normalized Interface" view, "LAN" is a normalized name, but FortiGateRugged-70F uses "lan1" as the actual interface. To resolve the conflict, the administrator must create a per-device mapping linking the normalized interface
"LAN" to "lan1" for the FortiGateRugged-70F device. This allows FortiManager to properly translate the interface name during policy installation.
NEW QUESTION # 49
Refer to the exhibit. An administrator created two new meta fields in FortiManager.
Which operation can you perform with these parameters?
- A. You can invoke them using the $ character.
- B. You can add them to objects as custom attributes.
- C. You can export them to be used in other ADOMs.
- D. You can use them as variables in scripts.
Answer: B
Explanation:
Meta fields in FortiManager can be added to objects as custom attributes, allowing administrators to categorize and add additional information to firewall objects for easier management and identification.
NEW QUESTION # 50
Refer to the exhibit.
Which two results occur if you run the script using theDevice Databaseoption? (Choose two.)
- A. The device Config Status is tagged as Modified.
- B. The successful execution of a script on the Device Database creates a new revision history.
- C. The script history shows the successful installation of the script on the remote FortiGate.
- D. The administrator must install these changes on a managed device using the Install Wizard.
Answer: A,D
Explanation:
Running a script on the Device Database marks the configuration as modified but does not immediately apply changes to the device.
The administrator must use the Install Wizard to push and install these changes from the Device Database onto the managed device.
NEW QUESTION # 51
Refer to the exhibits. An administrator runs the reload failure command diagnose test deploymanager reloadconf 262 on FortiManager.
Why does the administrator receive an error message?
- A. The administrator must use the FortiGate name instead of the ID number.
- B. The administrator just recently added FortiGate HQ-NGFW as a model device.
- C. FortiManager does not support FortiOS version 7.0.
- D. FortiManager requires the FortiGate serial number instead of the ID number.
Answer: B
Explanation:
The error occurs because the FortiGate HQ-NGFW device with ID 262 is a newly added model device and has not yet been fully synchronized or installed with a configuration package, which causes the reload configuration command to fail.
NEW QUESTION # 52
You are moving managed FortiGate devices from one ADOM to a new ADOM.
Which statement correctly describes the expected result?
- A. The shared policy package will not be moved to the new ADOM automatically.
- B. Any unused objects from a previous ADOM are moved to the new ADOM automatically.
- C. Policy packages will be imported into the new ADOM automatically.
- D. The shared device settings will be installed automatically.
Answer: A
Explanation:
When you move devices from one ADOM to another ADOM, shared policy packages and objects do not move to the new ADOM. You will need to import policy packages from managed devices.
NEW QUESTION # 53
Which output is displayed right after moving the ISFW device from one ADOM to another?
- A.
- B.
- C.
- D.
Answer: B
Explanation:
Never Installed - The assigned policy package is not the result of an import for this device, and the package has not been installed since it has been assigned to this device.
NEW QUESTION # 54
......
Dumps of FCP_FMG_AD-7.6 Cover all the requirements of the Real Exam: https://actualanswers.pass4surequiz.com/FCP_FMG_AD-7.6-exam-quiz.html