NSE6_FMG_AD-7.6 Fortinet NSE 6 - FortiManager 7.6 Administrator Questions and Answers

FortiManager helps with mass provisioning by using templates that allow administrators to configure the same settings on multiple FortiGate devices simultaneously, streamlining deployment and management.

Running a script on the Device Database marks the configuration as modified but does not immediately apply changes to the device.

The administrator must use the Install Wizard to push and install these changes from the Device Database onto the managed device.

The exhibits are directly supported by the lab guide’s troubleshooting section. It states: “The only profile that can be replaced is the Firewall Profile-Protocol-Options profile, because the only difference is a change in the comment field.” It then explains that for the other two profiles, “Whether you accept the value from BR1-FGT-1 or FortiManager, it will cause changes on different devices.”

That exactly matches C. The conflict window is not primarily showing a firmware mismatch, and the guide does not say BR1-FGT-1 lacks HTTPS 443 support. It also does not describe this as a FortiGuard database mismatch for QUIC. Instead, the key point is that only the default Firewall Profile-Protocol-Options conflict is minor enough to safely take from FortiManager because the difference is only in the comment field. The web filter and SSL/SSH profiles would cause real configuration differences if replaced.

The FortiManager 7.6 Administrator Study Guide is explicit for the scenario where both FortiManager and FortiGate are behind NAT. It states that FortiManager can discover FortiGate through the FortiGate NATed IP address, which makes A correct. It also explains that in this scenario, the FortiManager NATed IP address is not configured on FortiGate by default under central management, which makes B correct.

C is incorrect because FortiGate must use the FortiManager NATed IP address, not the non-NATed IP, if it needs to announce itself or reestablish the FGFM tunnel. D is also incorrect because in this NAT scenario, if the tunnel is torn down, only FortiGate attempts to reestablish the connection; FortiManager does not automatically do so.

=========

Running the script through the policy package or ADOM database method allows FortiManager to properly interpret object relationships and dependencies in the IPsec configuration, preventing object mismatch errors when pushing complex VPN settings directly via CLI.

When a script is run using Remote FortiGate Directly via CLI, FortiManager sends the commands straight to the FortiGate and does not preview or validate dependent objects first. The study guide also explains that scripts containing ADOM-level objects or dynamic mappings must be executed on the Policy Package or ADOM Database, then installed through the installation workflow. That matches this IPsec error scenario, where phase2-interface is referencing an object relationship that FortiManager cannot properly validate in direct CLI mode. Therefore, the administrator should run the script on the policy package or ADOM database method, then install it.

Option A addresses only one possible syntax issue. B is a valid deployment approach in general, but it is not what the question asks as the direct fix for this script execution error. C is incorrect and would not resolve the object dependency mismatch.

The correct answers are A and C. The FortiManager 7.6 Administrator Study Guide gives the exact extract: “FortiManager creates a configuration revision when: FortiGate is added to FortiManager, Device changes are installed from FortiManager, FortiGate configuration is retrieved from FortiManager, A local change on FortiGate causes an automatic update”.

This exactly proves A, because device changes are installed from FortiManager, and C, because a local change on FortiGate causes an automatic update. The guide also states: “By default, all changes made on a managed FortiGate device are automatically updated on FortiManager and reflected in revision history”.

B and D only modify the FortiManager device-level database status to Modified. They do not, by themselves, create a new revision history until an install, retrieve, or auto-update occurs.

Limiting ADOM revisions reduces the number of stored historical configurations, which helps avoid performance degradation and slow ADOM upgrades caused by a large volume of revisions.

The correct answers are A and C. The FortiManager 7.6 Administrator Study Guide states: “An ADOM revision creates a snapshot of all policy and object configurations for the ADOM”. The lab guide says the same thing in practical terms: “An ADOM revision creates a snapshot of the policy and object configuration for the ADOM” and that these revisions are useful for comparing differences and reverting to a previous revision.

Because the revision is a snapshot of the ADOM’s policy-and-object state, it saves the current ADOM policy/object state, which supports A and directly proves C. B is false because the study guide warns: “ADOM revisions can significantly increase the size of the configuration backup files.” D is not supported by the uploaded sources.

=========

Right after moving the ISFW device to a new ADOM, the status typically shows the policy package as never-installed, indicating that the device has been assigned to the new ADOM but no policy package has yet been installed in that ADOM.

The correct answer is B. The FortiManager 7.6 Administrator Study Guide explicitly states: “CLI scripts use the FGFM tunnel and the FGFM tunnel is authenticated using the FortiManager and FortiGate serial numbers.” It also states: “Tcl scripts do not run through the FGFM tunnel like CLI scripts do. Tcl scripts use SSH to tunnel through FGFM and they require SSH authentication to do so.”

This is the exact reason CLI scripts can run without prompting for SSH authentication every time: they use the existing secure FGFM management tunnel, not a separate interactive SSH login. The FGFM section of the study guide also confirms that this is a secure communication tunnel established between FortiManager and managed FortiGate devices.

So the enabler is not legacy login, script location, or the “Remote FortiGate Directly” option by itself. It is the FGFM secure management tunnel.

The command set workspace-mode normal enables Workspace (ALL ADOMs). The study guide states that in this mode “All ADOMs can be locked” and workspace mode lets administrators lock ADOMs, devices, policy packages, and objects. The lab guide then gives the exact behavior for ungraceful session closure: “If a session is not closed gracefully … FortiManager does not close the administrator session until it times out or the session is deleted. Until this time, the ADOM remains in a locked state.” That directly proves A.

C is also verified by the lab guide statement: “If an administrator locked one or more ADOMs, and then logs out of FortiManager, all of those ADOMs are unlocked.” The phrase “one or more ADOMs” confirms the same administrator can lock multiple ADOMs at once.

D is a workflow mode approval concept, not workspace normal.

Enabling workflow mode along with the ADOM lock feature ensures that all configuration changes go through a centralized review and approval process before installation, allowing controlled and coordinated management of firewall policies by multiple administrators.

The correct answer is C. The uploaded FortiManager 7.6 Administrator Lab Guide gives the exact extract: “FortiManager will update the universally unique identifiers (UUID) without deleting other configurations” and “UUIDs on both FortiGate and FortiManager are critical for ensuring the unique identification, consistency, and correct management of firewall policies across multiple devices and configurations. They provide a reliable and immutable reference for policies.”

The same source also shows administrators enabling UUIDs in Traffic Log on FortiGate log settings, which supports the logging and policy-correlation use case with FortiAnalyzer/FortiManager.

So the attribute that improves policy identification and logging correlation is the Universally Unique Identifier, not Policy ID, Log ID, or Sequence ID.

=========

ADOM revisions save the current state of all policy packages and objects within an ADOM, allowing administrators to track changes over time and revert to previous configurations if needed.

The correct answer is C. The FortiManager 7.6 Administrator Study Guide states that after adding the root FortiGate of a Security Fabric, all downstream devices in the fabric are automatically added as Unauthorized in the root ADOM. That directly matches option C.

This is important because the administrator created a FortiGate-only ADOM named Training, not a Fabric ADOM. The lab guide explains that a FortiGate ADOM is intended for FortiGate devices, while the Fabric type is the special ADOM type that allows FortiGate and other device types together.

So the downstream members are not automatically authorized, and they do not immediately appear as managed devices inside the Training ADOM. They first appear as unauthorized devices in the root ADOM, where the administrator can review and authorize them.

=========

When FortiManager is behind a NAT device, setting the NATed IP address (100.65.0.120) in the system admin settings causes FortiManager to use that NATed IP address for communication and configuration with FortiGate during discovery and management operations.