Which two statements about Security Fabric integration with FortiManager are true? (Choose two.

 A. The Fabric View module enables you to view the Security Fabric ratings for Security Fabric devices.

 B. The Security Fabric license, group name, and password are required for the FortiManager Security
Fabric integration.

 C. The Security Fabric settings are part of the device-level settings.

 D. The Fabric View module enables you to generate the Security Fabric ratings for Security Fabric
devices.

R: A,C

An administrator would like to create a policy on the Staging ADOM in backup mode, and install it on the
FortiGate device in the same ADOM.
How can the administrator perform this task?

 A. The administrator must change the ADOM mode to Advanced to bring the FortiManager online.

 B. The administrator must disable the FortiManager offline mode first.

 C. The administrator must use the Policy & Objects section to create a policy first.

R: A

What is the purpose of the Policy Check feature on FortiManager?

 A. It provides recommendations for optimizing policies in a policy package.

 B. It provides recommendations to combine similar policy packages within an ADOM into one single
policy package.

 C. It compares the policy packages with the revision history, and updates policy packages in the ADOM
database.

 D. It merges and creates dynamic mappings for duplicate objects used in a policy package.

R: A
An administrator's PC crashes before the administrator can submit a workflow session for approval. After the
PC is restarted, the administrator notices that the ADOM was locked from the session before the crash.
How can the administrator unlock the ADOM?

 A. Log in using the same administrator account to unlock the ADOM.

 B. Log in as Super_User in order to unlock the ADOM.

 C. Delete the previous admin session manually through the FortiManager GUI or CLI.

 D. Restore the configuration from a previous backup.

R: C

Refer to the exhibit.

Which two statements about an ADOM set in Normal mode on Fortitvlanager are true? (Choose two.)

 A. It supports the FortiManager script feature.

 B. You cannot assign the same ADOM to multiple administrators.

  C. FortiManager automatically installs the configuration difference in revisions on the managed
FortiGate.

 D. It allows making configuration changes for managed devices on FortiManager panes.

R: A, D

efer to the exhibit.

You are using the Quick Install option to install configuration changes on the managed FortiGate.
Which two statements correctly describe the result? (Choose two.)

 A. It installs all the changes in the device database first and the administrator must reinstall the changes
on the FortiGate device.

 B. It provides the option to preview only the policy package changes before installing them.

 C. It installs provisioning templates changes on the FortiGate device.

 D. It installs device-level changes on the FortiGate device without launching the Install Wizard.

R: C, D

Refer to the exhibit.

An administrator has configured the command shown in the exhibit on FortiManager. A configuration change
has been installed from FortiManager to the managed FortiGate that causes the FGFM tunnel to go down for
more than 15 minutes.
What is the purpose of this command?

 A. It allows FortiGate to unset central management settings.

 B. It allows FortiGate to reboot and restore a previously working firmware image.

 C. It allows FortiManager to revert and install a previous configuration revision on the managed
FortiGate.

 D. It allows FortiGate to reboot and recover the previous configuration from its configuration file.

R: D
An administrator would like to review, approve, or reject all the firewall policy changes made by the junior
administrators.
How should the workspace mode settings be configured on FortiManager?

 A. Set to read/write and using the policy locking feature

 B. Set to normal and using the approval group feature

 C. Set to workflow and using the ADOM locking feature

 D. Set to workspace and using the policy locking feature

R: C

What is the purpose of ADOM revisions?

 A. To create System Checkpoints for the FortiManager configuration

 B. To save the current state of all policy packages and objects for an ADOM

 C. To save the current state of the whole ADOM

 D. To revert individual policy packages and device-level settings for a managed FortiGate

R: B

An administrator configures a new OSPF route on FortiManager and has not yet pushed the changes to the
managed FortiGate device.
In which database will the configuration be saved?

 A. ADOM-level database

 B. Configuration-level database

 C. Revision history database

 D. Device-level database

R: D
What will happen if the script is executed using the Device Database option? (Choose two.)

 A. You must install these changes using the Install Wizard to a managed device.

 B. The successful execution of a script on the Device Database will create a new revision history.

 C. The script history will show successful installation of the script on the remote FortiGate.

 D. The Device Settings Status will be tagged as Modified.

R: A, D
An administrator logs in to the FortiManager GUI and sees the panes shown in the exhibit.
Which two reasons can explain why the FortiAnalyzer feature panes do not appear? (Choose two.)

 A. The administrator profile does not have full access privileges like the Super_User profile.

 B. The administrator IP address is not a part of the trusted hosts configured on FortiManager interfaces.

 C. The administrator logged in using the unsecure protocol HTTP, so the view is restricted.

 D. FortiAnalyzer features are not enabled on FortiManager.

R: A, D

A service provider administrator has assigned a global policy package to a managed customer ADOM named
My_ADOM, which has four policy packages. The customer administrator has access only to My_ADOM.
How can customer or service provider administrators remove both global header and footer policies from the
policy package named Shared_Package?

 A. The service provider administrator can unassign both global policies from My_ADOM.

 B. The service provider administrator can unassign both policies from the global ADOM.

 C. The customer administrator can unassign both global polices from My_ADOM.

 D. The customer administrator can unassign both polices by locking My_ADOM.

R: B
Which two statements about the output are true? (Choose two.)

 A. The latest revision history for the managed FortiGate does not match the device-level database.

 B. Configuration changes have been installed on FortiGate, which means the FortiGate configuration
has been changed.

 C. Configuration changes directly made on FortiGate have been automatically updated to the device-
level database.

 D. The latest revision history for the managed FortiGate does match the FortiGate running
configuration.

R: A, D

What will be the result of reverting to a previous revision version in the revision history?

 A. It will generate a new version ID and remove all other revision history versions.

 B. It will install configuration changes to managed device automatically.

 C. It will tag the device settings status as Auto-Update.

 D. It will modify the device-level database.

R: D

An administrator has assigned a global policy package to custom ADOM1. Then the administrator creates a
new policy package, Fortinet, in the custom ADOM1.
What will happen to the Fortinet policy package?

 A. When the Fortinet policy package is created, it automatically assigns the global policies.

 B. When the Fortinet policy package is created, you can select the option to assign the global policies.

 C. When the Fortinet policy package is created, you need to reapply the global policy package to the
ADOM.

 D. When the Fortinet policy package is created, you need to assign the global policy package from the
global ADOM.

R: A
A service provider administrator has assigned a global policy package to a managed customer ADOM named
My_ADOM, which has four policy packages. The customer administrator has access only to My_ADOM.
How can customer or service provider administrators remove both global header and footer policies from the
policy package named Shared_Package?

 A. The service provider administrator can unassign both global policies from My_ADOM.

 B. The service provider administrator can unassign both policies from the global ADOM.

 C. The customer administrator can unassign both global polices from My_ADOM.

 D. The customer administrator can unassign both polices by locking My_ADOM.

R: B

Which two statements about the output are true? (Choose two.)

 A. The latest revision history for the managed FortiGate does not match the device-level database.

 B. Configuration changes have been installed on FortiGate, which means the FortiGate configuration
has been changed.

 C. Configuration changes directly made on FortiGate have been automatically updated to the device-
level database.

 D. The latest revision history for the managed FortiGate does match the FortiGate running
configuration.

R: A, D

What will be the result of reverting to a previous revision version in the revision history?

 A. It will generate a new version ID and remove all other revision history versions.
  B. It will install configuration changes to managed device automatically.

 C. It will tag the device settings status as Auto-Update.

 D. It will modify the device-level database.

R: D

An administrator has enabled Service Access on FortiManager.

What is the purpose of Service Access on the FortiManager interface?

 A. It allows administrative access to FortiManager.

 B. It allows FortiManager to respond to requests for FortiGuard services from FortiGate devices.

 C. It allows FortiManager to determine the connection status of managed devices.

 D. It allows third-party applications to gain read/write access to FortiManager.

R: B

An administrator has assigned a global policy package to custom ADOM1. Then the administrator creates a
new policy package, Fortinet, in the custom ADOM1.
What will happen to the Fortinet policy package?

 A. When the Fortinet policy package is created, it automatically assigns the global policies.

 B. When the Fortinet policy package is created, you can select the option to assign the global policies.

 C. When the Fortinet policy package is created, you need to reapply the global policy package to the
ADOM.

 D. When the Fortinet policy package is created, you need to assign the global policy package from the
global ADOM.

R: A

You are moving managed FortiGate devices from one ADOM to a new ADOM.
Which statement correctly describes the expected result?

 A. Policy packages will be imported into the new ADOM automatically.

 B. Any pending device settings will be installed automatically.

 C. The shared policy package will not be moved to the new ADOM.

 D. Any unused objects from a previous ADOM are moved to the new ADOM automatically.

R: C
Which two statements regarding device management on FortiManager are true? (Choose two.)

 A. FortiGate devices in an HA cluster are counted as a single device.

 B. FortiGate devices in transparent mode configurations are not counted toward the device count on
FortiManager.

 C. The maximum number of managed devices for each ADOM is 500.

 D. FortiGate devices in an HA cluster that has five VDOMs are counted as five separate devices.

R: A, D

An administrator is replacing a failed device on FortiManager by running the following command: execute
device replace sn <devname> <serialnum>.
What device name and serial number must the administrator use?

 A. The device name of the new device and serial number of the failed device

 B. The device name and serial number of the new device

 C. The device name and serial number of the failed device

 D. The device name of the failed device and serial number of the new device

R: D

Refer to the exhibit.

Review the Download Import Report.

Why is it failing to import firewall policy ID 1?

 A. Policy ID 1 for this managed FortiGate already exists on FortiManager in the policy package named
Remote-FortiGate.

 B. Policy ID 1 is configured from the interface any to port6. FortiManager rejects the request to import
this policy because the any interface does not exist on FortiManager.
  C. Policy ID 1 does not have the ADOM Interface mapping configured on FortiManager.

 D. The address object used in policy ID 1 already exists in the ADOM database with any as the interface
association, and conflicts with the address object interface association locally on FortiGate.

R: D

Which two items does an FGFM keepalive message include? (Choose two.)

 A. FortiGate IPS version

 B. FortiGate uptime

 C. FortiGate configuration checksum

 D. FortiGate license information

R: A,C

Refer to the exhibit.

What is the purpose of setting ADOM Mode to Advanced?

 A. This setting enables the ADOMs feature on FortiManager.

 B. This setting allows you to assign a VDOM when offline mode is enabled.
  C. This setting disables concurrent ADOM access and adds ADOM locking.

 D. This setting allows you to assign a VDOM from a single device to a different ADOM.

R: D

Refer to the exhibit.

An administrator is about to add the FortiGate device to FortiManager using the discovery process.
FortiManager is operating behind a NAT device, and the administrator configured the FortiManager NATed IP
address under the FortiManager system administration settings.
What is the expected result?

 A. During discovery, FortiManager sets both the FortiManager NATed IP address and NAT device IP
address on FortiGate.

 B. During discovery, FortiManager uses only the FortiGate serial number to establish the connection.

 C. During discovery, FortiManager sets the FortiManager NATed IP address on FortiGate.

 D. During discovery, FortiManager sets the NATed device IP address on FortiGate.

R: C

In the event that one of the secondary FortiManager devices fails, which action must be performed to return the
FortiManager HA to a working state?

 A. Manually promote one of the working secondary devices to the primary role, and reboot the old
primary device to remove the peer IP of the failed device.

 B. The FortiManager HA state transition is transparent to administrators and does not require any
reconfiguration.

 C. Reconfigure the primary device to remove the peer IP of the failed device.

 D. Reboot the failed device to remove its IP from the primary device.

R: C
An administrator enabled workspace mode and now wants to delete an address object that is currently
referenced in a firewall policy.
What can the administrator expect to happen?

 A. FortiManager will replace the deleted address object with the none address object in the referenced
firewall policy.

 B. FortiManager will not allow the administrator to delete a referenced address object until the ADOM
is locked.

 C. FortiManager will leave the address object empty.

 D. FortiManager will temporary disable the status of the referenced firewall policy.

R: A

What does a policy package status of Conflict indicate?

 A. The policy package does not have FortiGate as the installation target.

 B. The policy package reports inconsistencies and conflicts during a Policy Consistency Check.

 C. The policy configuration has never been imported after a device was registered on FortiManager.

 D. The policy package configuration has been changed on both FordManager and the managed device
independently.

R: D

An administrator is tasked with troubleshooting an issue with push updates failing on a FortiManager device
that is located behind a NAT device.
Which two settings should the administrator check? (Choose two.)

 A. That the virtual IP address and correct ports are set on the NAT device

 B. That the NAT device IP address and correct ports are configured on FortiManager

 C. That the external IP address on the NAT device is set to DHCP and configured with the virtual IP

 D. That the override server IP address is set on FortiManager and the NAT device

R: A, B

FMG 6.4

You are moving managed FortiGate devices from one ADOM to a new ADOM.
Which statement correctly describes the expected result?
  A. Any unused objects from a previous ADOM are moved to the new ADOM automatically.
 B. The shared policy package will not be moved to the new ADOM.
 C. Policy packages will be imported into the new ADOM automatically.
 D. Any pending device settings will be installed automatically.

R: B

In the event that the primary FortiManager fails, which action must be performed to return the FortiManager
HA to a working state?

 A. The secondary device with the highest priority will automatically be promoted to the primary role,
and you must manually reconfigure all other secondary devices to point to the new primary device.
 B. FortiManager HA state transition is transparent to administrators and does not require any
reconfiguration.
 C. Manually promote one of the secondary devices to the primary role, and reconfigure all other
secondary devices to point to the new primary device.
 D. Reboot one of the secondary devices to promote it automatically to the primary role, and reconfigure
all other secondary devices to point to the new primary device.

R: C

Which three settings are the factory default settings on FortiManager? (Choose three.)

 A. FortiAnalyzer features are disabled

 B. Username is admin
 C. port1 interface IP address is 192.168.1.99/24
 D. Reports and Event Monitor panes are enabled
 E. Password is fortinet

R: A,B,C

What will happen if FortiAnalyzer features are enabled on FortiManager?

 A. FortiManager can be used only as a logging device.

 B. FortiManager will reboot.
 C. FortiManager will install the logging configuration to the managed devices.
 D. FortiManager will enable ADOMs to collect logs automatically from non-FortiGate devices

R: B

Which two items does an FGFM keepalive message include? (Choose two.)

 A. FortiGate configuration checksum

 B. FortiGate license information
 C. FortiGate IPS version
  D. FortiGate uptime

R: A, C

Which configuration setting for FortiGate is part of a device-level database on FortiManager?

 A. Firewall policies
 B. Security profiles
 C. VIP and IP Pools
 D. Routing

R: D

Which two conditions trigger FortiManager to create a new revision history? (Choose two.)

 A. When FortiManager installs device-level changes on a managed device

 B. When changes to the device-level database are made on FortiManager
 C. When FortiManager is auto-updated with configuration changes made directly on a managed device
 D. When a configuration revision is reverted to a previous revision in the revision history

R: A,B

When an installation is performed from FortiManager, what is the recovery logic used between FortiManager
and FortiGate for an FGFM tunnel?

 A. FortiManager will revert and install a previous configuration revision on the managed FortiGate.
 B. FortiManager will not push the CLI commands as part of the installation that will cause the tunnel to
go down.
 C. After 15 minutes, FortiGate will unset all CLI commands that were part of the installation that caused
the tunnel to go down.
 D. FortiGate will reject the CLI commands that will cause the tunnel to go down.

R: C

An administrator runs the reload failure command diagnose test deploymanager reloadconf <deviceid> on
FortiManager.
What does this command do?

 A. It compares and provides differences in configuration on FortiManager with the current running
configuration of the specified FortiGate.
 B. It downloads the latest configuration from the specified FortiGate and performs a reload operation on
the device database.
 C. It installs the provisioning template configuration on the specified FortiGate.
 D. It installs the latest configuration on the specified FortiGate and updates the revision history database.

R: B
An administrator with the Super_User profile is unable to log in to FortiManager because of an authentication
failure message.
Which troubleshooting step should you take to resolve the issue?

 A. Make sure the administrator IP address is part of the trusted hosts.

 B. Make sure FortiManager Access is enabled in the administrator profile.
 C. Make sure Offline Mode is disabled.
 D. Make sure ADOMs are enabled and the administrator has access to the Global ADOM.

R: A

What are two outcomes of ADOM revisions? (Choose two.)

 A. ADOM revisions can save the current state of the whole ADOM.
 B. ADOM revisions can create System Checkpoints for the FortiManager configuration.
 C. ADOM revisions can significantly increase the size of the configuration backups.
 D. ADOM revisions can save the current state of all policy packages and objects for an ADOM.

R: C, D

What does a policy package status of Modified indicate?

 A. The policy configuration has been changed on a managed device and changes have not yet been
imported into FortiManager.
 B. The policy package was never imported after a device was registered on FortiManager.
 C. FortiManager is unable to determine the policy package status.
 D. The policy configuration has been changed on FortiManager and changes have not yet been installed
on the managed device.

R: D