Fortinet FCP_FMG_AD-7.4 FCP - FortiManager 7.4 Administrator Exam Practice Test

This command is used to retrieve the current running configuration from the specified FortiGate device and updates the FortiManager's device database accordingly.

Option B: To save the current state of all policy packages and objects for an ADOMis the correct answer. ADOM (Administrative Domain) revisions in FortiManager are used to create a snapshot of the current state of all policy packages and objects associated with an ADOM. This allows administrators to save a specific configuration state and revert to it if necessary. It helps in managing changes and recovering from configuration errors or unintended changes.

Explanation of Incorrect Options:

Option A: To save the current state of the whole ADOMis incorrect because ADOM revisions specifically save only the policy packages and object configurations, not the entire state of the ADOM, which may include logs, reports, and other non-policy data.

Option C: To revert individual policy packages and device-level settings for a managed FortiGateis incorrect as ADOM revisions are not meant for reverting individual policy packages or device settings; they are designed to handle the entire set of policy packages and objects within an ADOM.

Option D: To save the FortiManager configuration in the System Checkpointsis incorrect because ADOM revisions do not function as system checkpoints for FortiManager itself; they are specific to ADOM policy packages and objects.

FortiManager References:

Refer to the FortiManager 7.4 Administration Guide, "ADOM Management" section, which describes the purpose and usage of ADOM revisions for configuration management and restoration.

In the context of the FortiManager JSON API, thesetmethod is used tocreate new objectsoroverwrite existing ones. The API allows administrators to manage FortiManager and its associated devices by automating tasks like configuration changes, policy updates, and object creation.

Explanation of Options:

A. Set:

This istrue. Thesetmethod is used to create a new object if it does not exist or overwrite an existing object if it already exists. This method is frequently used in API requests to configure settings and apply changes on FortiManager.

B. Add:

This isfalse. Theaddmethod is used to add new objects without overwriting any existing ones. It is used when you want to create a new entry and ensure it doesn't conflict with or replace an existing object.

C. Exec:

This isfalse. Theexecmethod is used to execute specific actions or commands, rather than creating or modifying objects. This is typically used for actions like running scripts or executing operational commands on FortiManager or FortiGate.

D. Update:

This isfalse. While "update" might seem relevant, FortiManager's API does not specifically use an "update" method for modifying or creating objects. Thesetmethod serves that function by both creating new objects and overwriting existing ones.

To create and install a policy on a FortiGate device in an ADOM (Administrative Domain) that is in backup mode, the administrator must use a FortiManager script. This is because backup mode restricts direct configuration changes, and scripts can be used to push specific configuration changes without altering the ADOM mode.

Options A, C, and D are incorrect because:

A requires the ADOM to be in normal or advanced mode to create policies directly in the Policy & Objects section.

C suggests disabling offline mode, which is irrelevant to the backup mode configuration.

D implies changing the ADOM mode, which is unnecessary if using a script to perform the task.

FortiManager References:

Refer to FortiManager 7.4 Administrator Guide: Working with ADOMs and Using Scripts for managing policies in backup mode.

FortiManager backups include:

A. All devices— This includes all device configurations managed by FortiManager, such as firewall policies, objects, and other settings.

D. Flash configuration— This consists of local FortiManager configurations stored in flash memory, such as system settings, scripts, and other locally-stored configurations.

Options B and C are incorrect because:

B (Firmware images)are not typically included in a FortiManager backup. Firmware images are usually stored separately and managed through a different process.

C (FortiGuard database)is incorrect as the FortiGuard database, which contains threat intelligence and security signatures, is not part of the standard FortiManager backup.

FortiManager References:

Refer to FortiManager 7.4 Administrator Guide: Backup and Restore Processes.

The session ID is used to authenticate the client for further requests, ensuring that subsequent API calls are made by an authenticated user.

This status means that the policy package has not yet been associated with the managed device since its registration in FortiManager. Essentially, no configuration from that policy package has been pushed to the device.

Even with Super_User rights, the ability to approve workflow sessions typically requires membership in a specific workflow approval group. If Trainer is not part of this group, they will not be able to approve the workflow session.

In the exhibit, the FortiManager CLI output displays the results of thetopcommand, which shows system processes, CPU usage, and memory (RAM) usage. We are specifically looking for the process responsible for downloading theweb and email filter databasesfrom the public FortiGuard servers. This process is typically handled by thefgdlinkdprocess.

Key information from the output:

Thefgdlinkdprocess is listed with aPID of 1463.

The%MEMcolumn shows that this process is using2.9%of the available RAM.

Evaluation of Options:

A. 2.9: This iscorrect. Thefgdlinkdprocess, which handles the web and email filter database downloads, is using2.9%of the available memory, as indicated in the%MEMcolumn.

B. 3.1: This is incorrect. The3.1%memory usage belongs to thefwmsvrdprocess, not the fgdlinkd process.

C. 1.5: This is incorrect. The1.5%memory usage belongs to thefclinkdprocess, not the fgdlinkd process.

D. 4.1: This is incorrect. The4.1%memory usage belongs to thefgdsvrprocess, not the fgdlinkd process.

If the script is run using the "Device Database" option on FortiManager, the following occurs:

A.You must install these changes on a managed device using the Install Wizard.

Running the script on the Device Database updates only the configuration in the FortiManager's database, not on the actual FortiGate device. To apply the changes, you need to use the Install Wizard to push these configurations to the managed device.

D.The device Config Status is tagged as Modified.

After running the script on the Device Database, FortiManager tags the device's configuration status as "Modified," indicating that there are pending changes that have not yet been installed on the device.

Options B and C are incorrect because:

Bsuggests a new revision history is created, but this only happens when changes are actually installed on the managed device.

Cimplies the script is directly executed on the FortiGate, which is not the case when using the Device Database option.

FortiManager References:

Refer to FortiManager 7.4 Administrator Guide: Scripting and Configuration Management.

Option B: 192.168.1.0/24is the correct answer. In FortiManager, when a firewall address object is defined and used across multiple policy packages without any Per-Device Mapping, the default value configured in the object definition (192.168.1.0/255.255.255.0) is applied to all devices. The exhibit shows that the address objectLOCAL_SUBNEThas a default IP/netmask of192.168.1.0/24. Therefore,FortiManager will use this default value for any FortiGate device that does not have a specific Per-Device Mapping configured.

Explanation of Incorrect Options:

Option A: FortiManager generates an error for each FortiGate without a per-device mapping defined for that objectis incorrect because FortiManager does not generate an error when a Per-Device Mapping is not set. Instead, it uses the default value provided in the object definition.

Option C: 192.168.1.0/28is incorrect because the default value is192.168.1.0/24, as seen in the exhibit, not/28.

Option D: FortiManager replaces the address object to noneis incorrect because FortiManager does not replace address objects to "none" when a Per-Device Mapping is missing; it uses the default value instead.

FortiManager References:

Refer to the FortiManager 7.4 Administration Guide, specifically in sections related to "Address Object Management" and "Per-Device Mapping," which detail the behavior of address objects without specific device mappings.

When a FortiGate device, like the ISFW (Internal Segmentation Firewall), is moved from one ADOM to another in FortiManager, the status of the device in the new ADOM will temporarily show some level of inconsistency or unknown state until the ADOM fully syncs and integrates the device.

In the provided options, we are analyzing the FortiManager diagnose dvm device list output for the ISFW device.

Explanation of the Outputs:

Option A:

The output shows that the device has the following status:

dev-db: not modified

conf: in sync

cond: OK

dm: retrieved

The key part here is the pkg: [unknown]. This suggests that the configuration package for the ADOM in the new environment is still in anunknown state, which happens right after moving the device to a new ADOM. FortiManager needs time to process the device's configuration before syncing it properly.

Option B:

This output shows thepkg: [out-of-sync]. This occursaftersome configuration mismatch is identified, but it is not the immediate output after moving a device to a new ADOM.

Option C:

This output showspkg: [never-installed], which indicates that no package was ever installed on the device. This status typically appears when a device is newly added to FortiManager but not immediately after moving it between ADOMs.

Option D:

This output showspkg: [imported], which indicates that the device configuration has been successfully imported into the new ADOM. This would occur after the device is fully synced, but not immediately after moving the device to a new ADOM.

Conclusion:

The output that is displayedimmediately after movingthe ISFW device from one ADOM to another isOption A, where the package status is still unknown (pkg: [unknown]) because FortiManager has not yet fully synchronized the device's configuration in the new ADOM.

When an administrator configures a new OSPF area on FortiManager but has not yet pushed the changes to the managed FortiGate device, the configuration is saved in theDevice-level database.

Explanation of Options:

A. Device-level database:

This istrue. When changes are made to a device's configuration on FortiManager, they are saved in theDevice-level database. This database stores the configuration for individual managed devices. The configuration changes remain here until they are pushed to the actual FortiGate device.

B. ADOM-level database:

This isfalse. The ADOM-level database holds configurations related to the entire ADOM (Administrative Domain), such as global settings that apply to all devices within the ADOM, rather than configurations specific to individual devices.

C. Configuration-level database:

This isfalse. The term "Configuration-level database" is not typically used in FortiManager terminology. Changes are stored in the device-level database and are applied when pushed to the FortiGate.

D. Revision history database:

This isfalse. The revision history database keeps track of previous versions of configurations after they have been pushed to the FortiGate device. It does not store unsaved or pending configurations that have not yet been applied to the device.