FCP_FMG_AD-7.4 FCP - FortiManager 7.4 Administrator Questions and Answers

The commandexecute fmprofile import-profile ADOM2 3547 /tmp/myfileis used to import a system template profile from the FortiManager file system. The path/tmp/myfileindicates a location in the FortiManager's local file system, from which the profile will be imported into the specified ADOM.

Options B, C, and D are incorrect because:

B, C, and Dsuggest importing from different databases, which is not accurate since the command explicitly refers to the file system location.

FortiManager References:

Refer to FortiManager 7.4 CLI Reference Guide: Commands for Profile Management.

The objects highlighted in the image (DMZ_SUBNET, ISP1_SUBNET, LAN_SUBNET) aremetadata variables.

C.They can be used as variables in scripts.

These metadata variables are placeholders that can be used in FortiManager scripts to dynamically insert specific values, enabling script flexibility and scalability across multiple devices or ADOMs.

Options A, B, and D are incorrect because:

Asuggests optional or required settings, which do not apply to metadata variables.

Bimplies they are available across all ADOMs by default, which is not always the case.

Dstates they cannot be created in the global database ADOM, but metadata variables are typically managed within ADOMs and can be utilized globally based on specific configurations.

FortiManager References:

Refer to FortiManager 7.4 Administrator Guide: Using Metadata Variables and Script Management.

In the context of the FortiManager JSON API, thesetmethod is used tocreate new objectsoroverwrite existing ones. The API allows administrators to manage FortiManager and its associated devices by automating tasks like configuration changes, policy updates, and object creation.

Explanation of Options:

A. Set:

This istrue. Thesetmethod is used to create a new object if it does not exist or overwrite an existing object if it already exists. This method is frequently used in API requests to configure settings and apply changes on FortiManager.

B. Add:

This isfalse. Theaddmethod is used to add new objects without overwriting any existing ones. It is used when you want to create a new entry and ensure it doesn't conflict with or replace an existing object.

C. Exec:

This isfalse. Theexecmethod is used to execute specific actions or commands, rather than creating or modifying objects. This is typically used for actions like running scripts or executing operational commands on FortiManager or FortiGate.

D. Update:

This isfalse. While "update" might seem relevant, FortiManager's API does not specifically use an "update" method for modifying or creating objects. Thesetmethod serves that function by both creating new objects and overwriting existing ones.

Two statements about Security Fabric integration with FortiManager that are true are:

A. The Fabric View module enables you to generate the Security Fabric ratings for Security Fabric devices.

The Fabric View module in FortiManager allows administrators to generate Security Fabric ratings, which assess the security posture of the entire Security Fabric environment.

C. The Fabric View module enables you to view the Security Fabric ratings for Security Fabric devices.

In addition to generating ratings, the Fabric View module provides visibility into the Security Fabric ratings for all connected devices, offering a consolidated view of security across the fabric.

Options B and D are incorrect because:

Bis misleading as the Security Fabric settings are generally configured and managed separately from other device-level settings.

Dis incorrect as there is no specific requirement for a Security Fabric license, group name, and password solely for FortiManager integration.

FortiManager References:

Refer to FortiManager 7.4 Security Fabric Integration Guide: Managing Security Fabric and Generating Security Fabric Ratings.

Option C: The administrator can reclaim the FortiGate to FortiManager protocol (FGFM) tunnel to get the device online.This is the correct answer. The exhibit shows a device in "Unknown" status, which indicates that the FortiManager cannot currently communicate with the device. Reclaiming the FGFM tunnel will help to restore connectivity by re-establishing the management tunnel between the FortiManager and the FortiGate.

Explanation of Incorrect Options:

Option A: The administrator must refresh the device to restore connectivityis incorrect because refreshing the device is unlikely to solve the connection issue when the status is "Unknown."

Option B: FortiManager lost internet connectivity, therefore, the device appears to be downis incorrect because FortiManager does not require internet connectivity to manage a FortiGate; it needs a direct connection to the device.

Option D: The administrator recently restored a FortiManager configuration fileis incorrect because the exhibit does not indicate a recent restoration of configuration.

FortiManager References:

Refer to "FortiManager Administration Guide" and the section on "Device Management and Connectivity" for more information about reclaiming FGFM tunnels.

Option A: Policy seq.S will be installed on all managed devices and VDOMs that are listed under Installation Targets.This is correct. The "Install On" column indicates that the policy is targeted for installation on all listed managed devices and VDOMs under Installation Targets.

Option D: Policy seq.# 1 will be installed on the ISFW device root[NAT] and Student[NAT] VDOMs only.This is correct. Policy sequence #1 specifies that it will be installed only on the ISFW device and the VDOMs 'root[NAT]' and 'Student[NAT]' as indicated by the "Install On" column.

Explanation of Incorrect Options:

Option B: Policy seq.# 3 will be skipped because no installation targets are specifiedis incorrect because it is clearly listed under "Installation Targets," which means it will be installed according to the specified configuration.

Option C: Policy seq.# 2 will not be installed on the Local-FortiGate root VDOM because there is no root VDOM in the Installation Targetis incorrect as the exhibit does not show any specific exclusion for seq.# 2 on the Local-FortiGate root VDOM.

FortiManager References:

Refer to the FortiManager Administration Guide sections on "Policy Packages" and "Policy Installation Targets" for more details.

Option A: To assign another global policy package later to the same ADOM, you must unassign this policy first.This is correct. FortiManager does not allow multiple global policy packages to be assigned to a single ADOM simultaneously. If you want to assign a different global policy package, the existing one must be unassigned first.

Option C: You can edit or delete all the global objects in the global ADOM.This is correct. Once a global policy package is assigned, you have the flexibility to edit or delete global objects in the global ADOM, affecting all ADOMs to which this package is assigned.

Explanation of Incorrect Options:

Option B: After you assign the global policy package to an ADOM, the impacted policy packages become hidden in that ADOMis incorrect because the policy packages do not become hidden; they are modified according to the global policies.

Option D: You must manually move the header and footer policies after the policy assignmentis incorrect because header and footer policies are automatically applied when assigned.

FortiManager References:

See the "Global Policy and ADOM Management" section in the FortiManager Administration Guide.