FCP_FMG_AD-7.4 FCP - FortiManager 7.4 Administrator Questions and Answers

When a root FortiGate device is added to a specific ADOM (like Training), the downstream devices (those that are part of the Security Fabric) will not automatically be authorized in that ADOM. They will typically appear as unauthorized until explicitly authorized by an administrator.

This status means that the policy package has not yet been associated with the managed device since its registration in FortiManager. Essentially, no configuration from that policy package has been pushed to the device.

Option A: To assign another global policy package later to the same ADOM, you must unassign this policy first.This is correct. FortiManager does not allow multiple global policy packages to be assigned to a single ADOM simultaneously. If you want to assign a different global policy package, the existing one must be unassigned first.

Option C: You can edit or delete all the global objects in the global ADOM.This is correct. Once a global policy package is assigned, you have the flexibility to edit or delete global objects in the global ADOM, affecting all ADOMs to which this package is assigned.

Explanation of Incorrect Options:

Option B: After you assign the global policy package to an ADOM, the impacted policy packages become hidden in that ADOMis incorrect because the policy packages do not become hidden; they are modified according to the global policies.

Option D: You must manually move the header and footer policies after the policy assignmentis incorrect because header and footer policies are automatically applied when assigned.

FortiManager References:

See the "Global Policy and ADOM Management" section in the FortiManager Administration Guide.

The configuration shown in the exhibit sets theworkspace-mode to normal. The workspace mode in FortiManager defines how configuration changes and administrative tasks are handled, specifically regarding locking and collaboration in ADOMs (Administrative Domains).

Understanding the workspace modes:

Normal Mode:In this mode, only one administrator at a time can lock and edit an ADOM. The changes made by one administrator must be completed and saved before another administrator can make changes. It prevents concurrent read-write access within the same ADOM.

Workflow Mode:This mode allows multiple administrators to work on different tasks within the same ADOM, but changes still need to be approved before being committed.

Explanation of Options:

A. You can validate administrator login attempts through external servers.

This option is unrelated to the workspace mode. External authentication servers can be used for administrator logins, but that is a different configuration setting (not related to workspace-mode).

B. The same administrator can lock more than one ADOM at the same time.

This istrue. InNormal mode, an administrator can lock multiple ADOMs, meaning they can work on more than one ADOM simultaneously, but each ADOM can only be accessed by one administrator at a time for read-write purposes.

C. Two or more administrators can make configuration changes at the same time, in the same ADOM.

This isfalse. InNormal mode, onlyone administratorcan have read-write access to an ADOM at a time. If another administrator attempts to make changes, they must wait until the ADOM is unlocked by the first administrator.

D. Concurrent read-write access to an ADOM is disabled.

This istrue. InNormal mode, concurrent read-write access is disabled. This means only one administrator at a time can make changes to an ADOM. Other administrators can view the ADOM in read-only mode but cannot make changes until the ADOM is unlocked.

In the exhibit, there is aPer-Device MappingforLocal-FortiGatewith an IP/Netmask of192.168.1.0/24. This means that when the firewall address objectLOCAL_SUBNETis installed onLocal-FortiGate, the per-device mapping will override the general address object value of10.0.5.0/24. Therefore, the IP/Netmask installed onLocal-FortiGatewill be192.168.1.0/24.

When push updates are failing on a FortiGate device behind a NAT device, the administrator should check:

A.That the override server IP address is set on FortiManager and the NAT device.

The override server IP should be configured to ensure that FortiManager uses the correct IP address that can traverse the NAT to reach the FortiGate device.

D.That the virtual IP address and correct ports are set on the NAT device.

The NAT device must have the correct virtual IP (VIP) configured to map the FortiGate's internal IP to an external address, along with the correct ports needed for communication.

Options B and C are incorrect because:

Bsuggests setting the external IP on the NAT device to DHCP, which is not relevant to solving the push update issue.

Cimplies configuring NAT device IP and ports on FortiManager, which is less likely needed compared to configuring the correct VIP and ports.

FortiManager References:

Refer to FortiManager 7.4 Administrator Guide: Device Management and NAT Configuration.

Option B: Routingis the correct answer. The ADOM-level database in FortiManager stores configuration settings such as routing, firewall policies, and objects that are shared across multiple devices in the ADOM.

Explanation of Incorrect Options:

Option A: NSX-T Service Templateis incorrect as it is not a FortiGate-specific setting managed at the ADOM level.

Option C: SNMPis incorrect because SNMP settings are typically managed on a per-device basis.

Option D: Security profilesis incorrect because security profiles are generally device-level configurations, not ADOM-level.

FortiManager References:

Refer to "FortiManager Administration Guide" for further details on ADOM-level and device-level configurations.

When adding a FortiGate device to FortiManager that is operating behind a NAT device, and the FortiManager NATed IP address is configured under the system administration settings, FortiManager will set the FortiManager NATed IP address on the FortiGate device during the discovery process. This ensures that the FortiGate knows how to reach the FortiManager through the NAT device.

Options A, B, and C are incorrect because:

Ais incorrect because the discovery process also requires knowing the NATed IP to establish a connection, not just the serial number.

Bis incorrect because FortiManager does not set the NAT device's IP address on the FortiGate.

Cis incorrect because it implies that the NAT device IP is set on FortiGate, which is not the expected outcome.

FortiManager References:

Refer to FortiManager 7.4 Administrator Guide: Device Discovery and Management with NAT.

In the context of the FortiManager JSON API, thesetmethod is used tocreate new objectsoroverwrite existing ones. The API allows administrators to manage FortiManager and its associated devices by automating tasks like configuration changes, policy updates, and object creation.

Explanation of Options:

A. Set:

This istrue. Thesetmethod is used to create a new object if it does not exist or overwrite an existing object if it already exists. This method is frequently used in API requests to configure settings and apply changes on FortiManager.

B. Add:

This isfalse. Theaddmethod is used to add new objects without overwriting any existing ones. It is used when you want to create a new entry and ensure it doesn't conflict with or replace an existing object.

C. Exec:

This isfalse. Theexecmethod is used to execute specific actions or commands, rather than creating or modifying objects. This is typically used for actions like running scripts or executing operational commands on FortiManager or FortiGate.

D. Update:

This isfalse. While "update" might seem relevant, FortiManager's API does not specifically use an "update" method for modifying or creating objects. Thesetmethod serves that function by both creating new objects and overwriting existing ones.

The statement that is true about the policy lock feature on FortiManager is:

A. Policy locking is available in workspace normal mode.

In FortiManager, when working in "workspace-mode normal," policies can be locked by administrators to prevent other administrators from editing them simultaneously. This ensures that only one administrator makes changes at any given time, reducing conflicts or mistakes due to concurrent modifications.

Statements B, C, and D are incorrect because:

B is incorrect since locking a policy does not override a locked ADOM. The ADOM lock takes precedence.

C is incorrect because when a policy is locked, it does not necessarily mean the ADOM is locked.

D is incorrect because administrators in the approval group cannot work concurrently on a locked policy; the policy lock prevents concurrent modifications.

FortiManager References:

Refer to FortiManager 7.4 Administrator Guide: Policy and Objects > Policy Locking to understand how the policy lock feature functions in different workspace modes.

Option B: It allows FortiManager to respond to requests for FortiGuard services from FortiGate devices.This is the correct answer. When Service Access is enabled on FortiManager, it allows FortiManager to act as a local FortiGuard server for the managed FortiGate devices. This enables the FortiManager to respond to requests for FortiGuard services, such as updates for antivirus, web filtering, and other security services.

Explanation of Incorrect Options:

Option A: It allows administrative access to FortiManageris incorrect because Service Access is specifically for FortiGuard service communication, not for administrative access.

Option C: It allows third-party applications to gain read/write access to FortiManageris incorrect because Service Access does not provide API or third-party access capabilities.

Option D: It allows FortiManager to determine the connection status of managed devicesis incorrect because Service Access does not directly manage or check connectivity status of devices; it is used for FortiGuard service requests.

FortiManager References:

Refer to the "FortiManager Administration Guide," particularly the sections on "Service Access Settings" and "FortiGuard Services."

The commandexecute fmprofile import-profile ADOM2 3547 /tmp/myfileis used to import a system template profile from the FortiManager file system. The path/tmp/myfileindicates a location in the FortiManager's local file system, from which the profile will be imported into the specified ADOM.

Options B, C, and D are incorrect because:

B, C, and Dsuggest importing from different databases, which is not accurate since the command explicitly refers to the file system location.

FortiManager References:

Refer to FortiManager 7.4 CLI Reference Guide: Commands for Profile Management.

Even with Super_User rights, the ability to approve workflow sessions typically requires membership in a specific workflow approval group. If Trainer is not part of this group, they will not be able to approve the workflow session.