FCP_FMG_AD-7.4 FCP - FortiManager 7.4 Administrator Questions and Answers

Option B: To save the current state of all policy packages and objects for an ADOMis the correct answer. ADOM (Administrative Domain) revisions in FortiManager are used to create a snapshot of the current state of all policy packages and objects associated with an ADOM. This allows administrators to save a specific configuration state and revert to it if necessary. It helps in managing changes and recovering from configuration errors or unintended changes.

Explanation of Incorrect Options:

Option A: To save the current state of the whole ADOMis incorrect because ADOM revisions specifically save only the policy packages and object configurations, not the entire state of the ADOM, which may include logs, reports, and other non-policy data.

Option C: To revert individual policy packages and device-level settings for a managed FortiGateis incorrect as ADOM revisions are not meant for reverting individual policy packages or device settings; they are designed to handle the entire set of policy packages and objects within an ADOM.

Option D: To save the FortiManager configuration in the System Checkpointsis incorrect because ADOM revisions do not function as system checkpoints for FortiManager itself; they are specific to ADOM policy packages and objects.

FortiManager References:

Refer to the FortiManager 7.4 Administration Guide, "ADOM Management" section, which describes the purpose and usage of ADOM revisions for configuration management and restoration.

Option A: To assign another global policy package later to the same ADOM, you must unassign this policy first.This is correct. FortiManager does not allow multiple global policy packages to be assigned to a single ADOM simultaneously. If you want to assign a different global policy package, the existing one must be unassigned first.

Option C: You can edit or delete all the global objects in the global ADOM.This is correct. Once a global policy package is assigned, you have the flexibility to edit or delete global objects in the global ADOM, affecting all ADOMs to which this package is assigned.

Explanation of Incorrect Options:

Option B: After you assign the global policy package to an ADOM, the impacted policy packages become hidden in that ADOMis incorrect because the policy packages do not become hidden; they are modified according to the global policies.

Option D: You must manually move the header and footer policies after the policy assignmentis incorrect because header and footer policies are automatically applied when assigned.

FortiManager References:

See the "Global Policy and ADOM Management" section in the FortiManager Administration Guide.

FortiManager backups include:

A. All devices— This includes all device configurations managed by FortiManager, such as firewall policies, objects, and other settings.

D. Flash configuration— This consists of local FortiManager configurations stored in flash memory, such as system settings, scripts, and other locally-stored configurations.

Options B and C are incorrect because:

B (Firmware images)are not typically included in a FortiManager backup. Firmware images are usually stored separately and managed through a different process.

C (FortiGuard database)is incorrect as the FortiGuard database, which contains threat intelligence and security signatures, is not part of the standard FortiManager backup.

FortiManager References:

Refer to FortiManager 7.4 Administrator Guide: Backup and Restore Processes.

Option B: Routingis the correct answer. The ADOM-level database in FortiManager stores configuration settings such as routing, firewall policies, and objects that are shared across multiple devices in the ADOM.

Explanation of Incorrect Options:

Option A: NSX-T Service Templateis incorrect as it is not a FortiGate-specific setting managed at the ADOM level.

Option C: SNMPis incorrect because SNMP settings are typically managed on a per-device basis.

Option D: Security profilesis incorrect because security profiles are generally device-level configurations, not ADOM-level.

FortiManager References:

Refer to "FortiManager Administration Guide" for further details on ADOM-level and device-level configurations.

When adding a FortiGate device to FortiManager that is operating behind a NAT device, and the FortiManager NATed IP address is configured under the system administration settings, FortiManager will set the FortiManager NATed IP address on the FortiGate device during the discovery process. This ensures that the FortiGate knows how to reach the FortiManager through the NAT device.

Options A, B, and C are incorrect because:

Ais incorrect because the discovery process also requires knowing the NATed IP to establish a connection, not just the serial number.

Bis incorrect because FortiManager does not set the NAT device's IP address on the FortiGate.

Cis incorrect because it implies that the NAT device IP is set on FortiGate, which is not the expected outcome.

FortiManager References:

Refer to FortiManager 7.4 Administrator Guide: Device Discovery and Management with NAT.

When operating in workspace mode on FortiManager 7.4, the administrator must understand how object references and deletions work:

Option C- "FortiManager will not allow the administrator to delete a referenced address object until they lock the ADOM":In workspace mode, all changes are managed within an Administrative Domain (ADOM) scope. When an object (like an address object) is referenced in a policy, FortiManager prevents its deletion to maintain configuration integrity. The ADOM must be locked by the administrator to make changes to any referenced objects. This locking mechanism ensures that no unintended deletions or changes occur that could disrupt the policies or configuration.

FortiManager Reference: "In workspace mode, changes to objects or policies require the ADOM to be locked. If an object is referenced, you must lock the ADOM before deleting or modifying the object." (FortiManager 7.4 Administration Guide, Section on Workspace Mode and ADOM Management)

Option D- "FortiManager will replace the deleted address object with the none address object in the referenced firewall policy":If the administrator attempts to delete an address object that is currently referenced by a firewall policy, FortiManager will replace the deleted object with the 'none' address object. This is done to maintain the policy structure and avoid policy corruption due to a missing reference. This behavior ensures that the firewall policy remains syntactically correct, even though the specific address object is no longer in use.

FortiManager Reference: "When a referenced object is deleted, FortiManager will replace it with a 'none' object in the policy. This behavior is to ensure the integrity and continuity of the policy configurations." (FortiManager 7.4 Administration Guide, Object Management and Policy Handling in Workspace Mode)

Option B: It provides the option to preview only the policy package changes before installing them.This is correct. The Quick Install option in FortiManager provides a preview of policy changes before they are applied, allowing administrators to review and confirm the changes.

Option D: It installs device-level changes on the FortiGate device without launching the Install Wizard.This is correct. Quick Install allows for the immediate installation of device-level changes, such as interface or routing configurations, directly onto the FortiGate without going through the full Install Wizard.

Explanation of Incorrect Options:

Option A: It installs provisioning template changes on the FortiGate deviceis incorrect because Quick Install does not specifically deal with provisioning templates.

Option C: It installs all the changes in the device database first and the administrator must reinstall the changes on the FortiGate deviceis incorrect because Quick Install directly applies changes to the FortiGate device, not requiring a separate reinstall step.

FortiManager References:

Refer to "FortiManager Administration Guide" for details on "Quick Install" functionality under "Device Management."

In workflow mode, changes made by junior administrators can be submitted for review. The administrator can then approve or reject these changes before they are applied. This ensures proper oversight and control over policy changes.

Meta fields in FortiManager can be used to add additional metadata or custom attributes to various objects, such as firewall addresses or other configuration objects. These meta fields help in organizing and identifying objects with custom information that is not part of the standard configuration. They are particularly useful for categorizing or tagging objects in large environments.

In the exhibit, there is aPer-Device MappingforLocal-FortiGatewith an IP/Netmask of192.168.1.0/24. This means that when the firewall address objectLOCAL_SUBNETis installed onLocal-FortiGate, the per-device mapping will override the general address object value of10.0.5.0/24. Therefore, the IP/Netmask installed onLocal-FortiGatewill be192.168.1.0/24.