NSE6_FMG_AD-7.6 Fortinet NSE 6 - FortiManager 7.6 Administrator Questions and Answers

The best verified answer is B. The FortiManager 7.6 Administrator Study Guide shows that the ADOM Layer contains Policy and Objects, and specifically states: “Policy & Objects: Centralize the management of firewall policies, objects, and security profiles, among others.” Because security-related policy settings belong to the Policy and Objects layer, they are part of the ADOM-level database.

By contrast, Routing and SNMP are treated as device-level settings. The lab guide shows Routing under the device/network configuration view, and SNMP as a setting in the system template that “pushes configuration changes to the device level.”

Also, provisioning templates such as NSX-T service are listed as having precedence over device-layer configurations, which further indicates they are not the Policy and Objects ADOM database answer here.

=========

When FortiManager is behind a NAT device, setting the NATed IP address (100.65.0.120) in the system admin settings causes FortiManager to use that NATed IP address for communication and configuration with FortiGate during discovery and management operations.

The error occurs because the FortiToken used (FTKM0B4A9AC5C56D) must already exist and be registered on the FortiGate device HQ-NGFW-1. FortiManager cannot push or create new FortiTokens on the device; the token must be valid and present on the FortiGate before it can be assigned to a user.

The FortiManager 7.6 Administrator Study Guide states that global policies must be explicitly assigned: “You must explicitly assign global policy packages to specific ADOMs,” and FortiManager can also target specific policy packages in individual ADOMs. The lab guide confirms that assignment is performed from the Global Database ADOM: the administrator selects Global Database ADOM, clicks Assignment, adds the ADOM, chooses Specify Policy Packages To Assign, selects the target package, and then clicks Assign.

So creating a new policy package inside ADOM1 does not automatically inherit the existing global package assignment. It also does not automatically install policies. The administrator must go back to the global ADOM and assign the global policy package to that new local policy package.

The correct answer is B. The FortiManager 7.6 Administrator Study Guide gives the exact extract: “Also note when you upgrade the FortiManager firmware version the existing ADOMs are not automatically upgraded.” This directly explains why the administrator saw the FortiManager upgrade complete while the ADOM versions remained unchanged.

The same section also explains that ADOM upgrades are a separate action: “You can upgrade an ADOM in System Settings > ADOMs” and “Can upgrade to one version higher at a time.” In addition, the guide recommends: “upgrade all devices first, and then upgrade the ADOM.”

So the issue is not workspace mode, locked ADOMs, or a stuck task. The ADOMs simply require their own manual upgrade step after the FortiManager firmware upgrade.

ADOM revisions save the current state of all policy packages and objects within an ADOM, allowing administrators to track changes over time and revert to previous configurations if needed.

FortiManager helps with mass provisioning by using templates that allow administrators to configure the same settings on multiple FortiGate devices simultaneously, streamlining deployment and management.

The correct answer is B. The error occurs because the script is being run on the policy package database, but the failing command is config sys interface, which is a device-level configuration command, not a policy-layer command. The lab guide gives the exact relationship: “Because the scripts target the device database, first, you will run the scripts against the device database, and then install the scripts on the managed devices” and “The scripts contain configuration changes related to device-level settings.”

By contrast, the lab guide shows Policy Package or ADOM Database scripts being used for firewall objects and policies in a policy package.

So this NetFlow script must be run on the device database, then installed. The issue is not VDOM permissions, metadata variables, or normalized interfaces.

Enabling a workflow with approval ensures that any policy package changes must be reviewed and approved before installation, preventing administrators from repeating configuration mistakes and enforcing change control.

The correct answer is B. The FortiManager 7.6 Administrator Study Guide gives the exact extract: “Performing a revert operation followed by an installation only reverts device-level changes and does not revert policy packages. To achieve full synchronization, you must run the Import Configuration tool on FortiManager to synchronize the policy package.”

The guide also states: “After every retrieve, auto-update, or revert operation, you must use Import Configuration to ensure the policy information is synchronized.”

In the exhibit, the missing unset comment for policy ID 1 is a policy package issue, not just a device-level revert issue. Reinstalling the existing policy package does not automatically rebuild it from the reverted revision. The administrator must import the firewall policies again so the policy package reflects the reverted policy state. That is why the comment was not removed.

=========

The FortiManager 7.6 Administrator Study Guide is explicit for the scenario where both FortiManager and FortiGate are behind NAT. It states that FortiManager can discover FortiGate through the FortiGate NATed IP address, which makes A correct. It also explains that in this scenario, the FortiManager NATed IP address is not configured on FortiGate by default under central management, which makes B correct.

C is incorrect because FortiGate must use the FortiManager NATed IP address, not the non-NATed IP, if it needs to announce itself or reestablish the FGFM tunnel. D is also incorrect because in this NAT scenario, if the tunnel is torn down, only FortiGate attempts to reestablish the connection; FortiManager does not automatically do so.

=========

The command set workspace-mode normal enables Workspace (ALL ADOMs). The study guide states that in this mode “All ADOMs can be locked” and workspace mode lets administrators lock ADOMs, devices, policy packages, and objects. The lab guide then gives the exact behavior for ungraceful session closure: “If a session is not closed gracefully … FortiManager does not close the administrator session until it times out or the session is deleted. Until this time, the ADOM remains in a locked state.” That directly proves A.

C is also verified by the lab guide statement: “If an administrator locked one or more ADOMs, and then logs out of FortiManager, all of those ADOMs are unlocked.” The phrase “one or more ADOMs” confirms the same administrator can lock multiple ADOMs at once.

D is a workflow mode approval concept, not workspace normal.

The FortiManager 7.6 Administrator Study Guide states under Copying System Templates Between ADOMs: “The first step is to export the system template from the original ADOM with the execute fmprofile export-profile command” and shows the output file being written to /tmp/Training, described as “File copied in FortiManager tmp folder.”

The key point is that the command exports the system template profile from the original ADOM, while /tmp/Backup_File is only the destination path on FortiManager where the exported file is stored. The same study guide also defines system templates as a “subset of model device configuration—system-level settings”, which means they belong to the device-level side of the ADOM, not the policy database.

So the export source is the ADOM device database, and the file is saved afterward in the FortiManager /tmp folder.

The correct answer is B because FortiManager supports ADOM-level metadata variables in scripts and templates. The study guide explicitly states that meta fields cannot be used as variables in scripts or provisioning templates; instead, you must use ADOM-level metadata variables. It further says these variables can be used in templates, and their values can be mapped depending on the device where the template is applied.

That makes metadata variables the proper method for handling per-device differences such as whether a FortiGate should use a LAN or WAN source interface for FortiAnalyzer communication. A is wrong because per-device dynamic objects apply to objects like addresses and VIPs, not template interface selection. D is wrong because meta fields are comments/attributes, not template variables. C could work operationally, but it is not the FortiManager feature intended for this use case.

=========

The error occurs because the FortiGate HQ-NGFW device with ID 262 is a newly added model device and has not yet been fully synchronized or installed with a configuration package, which causes the reload configuration command to fail.

The import process shows that FortiManager will create normalized interfaces named LAN, port4, and port6 at the ADOM layer, mapping them to the corresponding device interfaces based on the import settings.