[Mar 14, 2026] Get to the Top with FCP_FMG_AD-7.6 Practice Exam Questions [Q15-Q37]

Rate this post

[Mar 14, 2026] Get to the Top with FCP_FMG_AD-7.6 Practice Exam Questions

Use Real FCP_FMG_AD-7.6 Dumps Free Sample Questions and Practice Test Engine

Fortinet FCP_FMG_AD-7.6 Exam Syllabus Topics:

Topic	Details
Topic 1	Troubleshooting
Topic 2	Administration: This section of the exam measures the skills of System Administrators and covers the essential features of FortiManager. It includes the initial configuration process and the setup of administrative domains (ADOMs), ensuring smooth system management.
Topic 4	Device Manager: This section of the exam measures the skills of Network Security Engineers and focuses on registering devices within ADOMs and handling device configurations. Candidates also learn how to install changes through scripts and diagnose issues using the revision history.

NO.15 Refer to the exhibits.

An administrator needs to push a FortiToken Mobile to assign it to HR_user in the HQ-NGFW-1.
However, when installing the policy package, they receive the following error message:

Why is the administratornotable to install the FortiToken on the HQ-NGFW-1 firewall?

The administrator must use a user local meta field to assign FortiToken.

The administrator must use a valid FortiToken that exists on HQ-NGFW-1.

The administrator must use a metadata variable to assign the same FortiToken to multiple users in FortiManager.

The administrator must use per-device mapping to assign the FortiToken to HQ-NGFW-1.

NO.16 What allows FortiManager to run CLI scripts on FortiGate devices without prompting for SSH authentication each time?

FortiGate devices using the legacy login method.

The secure management tunnel between FortiManager and FortiGate devices.

The script using the Remote FortiGate Directly (via CLI) option.

The script on the FortiManager device database.

NO.17 Refer to the exhibit. FortiManager is operating behind a network address translation (NAT) device, and the administrator configured the FortiManager NATed IP address under the FortiManager system administration settings.

What is the expected result during discovery?

FortiManager sets both the 100.65.0.120 IP address and 10.0.13.120 IP address on FortiGate.

FortiManager sets both the 100.65.0.120 IP address and 100.65.0.101 IP address on FortiGate.

FortiManager sets the 100.65.0.101 IP address on FortiGate.

FortiManager sets the 100.65.0.120 IP address on FortiGate.

NO.18 An administrator wants to configure and manage multiple objects in the FortiManager database and give access to other users who work in the same database.
To stay in control of the changes made to firewall policies by other team members, the administrator needs a setup where all modifications go through a central check before they can be installed.
How can the administrator create this setup?

Enable the prompt asking the administrator to accept firewall policies changes before saving.

Enable the workspace (for all ADOMs) to control all changes made by any administrator.

Enable device lock and the advanced mode feature in the ADOM.

Enable workflow mode and the ADOM lock feature.

NO.19 What are two outcomes of ADOM revisions? (Choose two.)

ADOM revisions can save the current state of the entire ADOM.

ADOM revisions do not increase the size of configuration backups.

ADOM revisions can save the current state of all policy packages and objects for an ADOM.

ADOM revisions appear in the Install Policy & Package Settings section of the install wizard.

NO.20 Refer to the exhibit. Which two statements about the output are true? (Choose two.)

The latest revision history for the managed FortiGate does not match the device-level database.

Configuration changes have been installed on FortiGate, updating policy and device-level database.

The latest revision history for the managed FortiGate does match the FortiManager policy database.

The system template default will override device-level database configurations.

NO.21 Refer to the exhibit. What percent of the available RAM is being used by the process in charge of downloading the web and email filter databases from the public FortiGuard servers?

2.9

3.1

1.5

4.1

NO.22 Refer to the exhibits.

An administrator needs to push a FortiToken Mobile to assign it to HR_user in the HQ-NGFW-1.
However, when installing the policy package, they receive the following error message:

Why is the administrator not able to install the FortiToken on the HQ-NGFW-1 firewall?

The administrator must use a user local meta field to assign FortiToken.

The administrator must use a valid FortiToken that exists on HQ-NGFW-1.

The administrator must use a metadata variable to assign the same FortiToken to multiple users in FortiManager.

The administrator must use per-device mapping to assign the FortiToken to HQ-NGFW-1.

NO.23 Refer to the exhibits. An administrator admin used the Configuration Revision History window to revert the FortiGate device configuration to revision ID 6. After running the reinstall policy package, the administrator noticed problems with the firewall policy- they could not see the unset comment on policy ID 1.
Why did FortiManager not remove the comment from policy ID 1 when the administrator ran reinstall policy package?

Because the administrator student must install the configuration changes to correctly see the expected results.

Because the administrator must import the firewall policies to update the firewall policy package.

Because every time the administrator uses the revert configfile, they must use the Install Wizard instead of running the reinstall policy package.

Because the administrator used the Revision Diff view, which shows what changed, not what will be installed.

NO.24 While attempting to push a NetFlow configuration script through the FortiManager policy package:
an administrator encounters an error stating that an object is unrecognized in line 4.

What must the administrator do to successfully apply the NetFlow configuration script and avoid the object unrecognized error?

Make sure the user running the script has full access to the VDOM–AGEUSR.

Run the script on the device database.

Use metadata variables if they use VDOMs in the script.

Create a normalized interface on the policy layer before running the script.

NO.25 Refer to the exhibits.

FortiGate HQ-NGFW-1 downloads and validates FortiGuard databases from FortiManager which acts as a local FortiGuard Distribution Server (FDS) in a closed network. An administrator pushes a new firewall policy with an intrusion prevention system (IPS) profile from FortiManager to FortiGate HQ- NGFW-1 However, FortiGate does not recognize the new IPS signature from FortiManager.
What is the most likely reason why FortiGate HQ-NGFW-1 does not recognize the new IPS signature?

FortiGate must enable rating for the FortiManager IP address, 192.168.1.120, in server list 1.

FortiManager and FortiGate have different IPS database versions.

The administrator must enable IPv6 connections for FortiGuard services on FortiManager.

The administrator must enable the fortiguard-anycast option to correctly download all signatures from the local FDS.

NO.26 A FortiManager administrator has moved a FortiGate device to a new ADOM, but they cannot see the policy or object configurations for that FortiGate.
What should the administrator do to see the policy or object configurations?

Use ADOM shared objects to restore all missing data.

Reset the device and add it to the new ADOM again.

Import the policy package manually using the Import Configuration wizard.

Use ADOM sync to restore the missing configurations.

NO.27 Refer to the exhibit. What are two results from the configuration shown in the exhibit? (Choose two.)

The same administrator can lock more than one ADOM at the same time.

Multiple administrators can lock and work on separate AOMs at the same time.

All changes must be approved before they can be installed on a device.

Concurrent read-write access to an ADOM is disabled.

NO.28 An administrator has a FortiGate-HQ device with VDOMs-root, HR and Facilities, currently managed under the FortiManager ADOM-Site1. They try to move VDOM HR to the FortiManager ADOM-Site2, but it does not work.
Why is the administrator not able to move FortiGate-HQ VDOM HR to FortiManager ADOM-Site2?

The FortiGate-HQ must be managed under the FortiManager ADOM-root to allow moving its VDOMs to different ADOMs.

The administrator must have full access in the device layer of FortiGate-HQ VDOM-root before they can VDOMs to different ADOMs.

FortiManager must be in ADOM normal mode, which does not allow VDOMs to be managed separately.

The administrator must delete the FortiGate-HQ device from FortiManager and add it again using the Add Device wizard before moving the VDOM.

NO.29 An administrator has assigned a global policy package to a new ADOM named ADOM1. What will happen if the administrator tries to create a new policy package in ADOM1?

The administrator will be able to select the option to assign the global policy package to the new policy package.

FortiManager will automatically assign the global policy package to the new policy package.

FortiManager will automatically install policies on the policy package in ADOM1.

The administrator will have to assign the global policy package from the global ADOM.

NO.30 Refer to the exhibits. An administrator runs the reload failure command diagnose test deploymanager reloadconf 262 on FortiManager.
Why does the administrator receive an error message?

The administrator must use the FortiGate name instead of the ID number.

The administrator just recently added FortiGate HQ-NGFW as a model device.

FortiManager requires the FortiGate serial number instead of the ID number.

FortiManager does not support FortiOS version 7.0.

NO.31 What are two expected results when both FortiManager and FortiGate are behind network address translation (NAT) devices? (Choose two.)

During discovery, the FortiManager NATed IP address is not set by default on FortiGate.

FortiGate is discovered by FortiManager through the FortiGate NATed IP address.

If the FortiGate-FortiManager communication protocol (FGFM) tunnel is torn down, FortiManager will try to reestablish the FGFM tunnel.

FortiGate can announce itself to FortiManager only if the FortiManager non-NATed IP address is configured on FortiGate under central management.

NO.32 Which two items does an FGFM keepalive message include? (Choose two.)

FortiGate IPS version

FortiGate license information

FortiGate configuration checksum

FortiGate uptime

NO.33 You are moving managed FortiGate devices from one ADOM to a new ADOM.
Which statement correctly describes the expected result?

The shared device settings will be installed automatically.

The shared policy package will not be moved to the new ADOM automatically.

Any unused objects from a previous ADOM are moved to the new ADOM automatically.

Policy packages will be imported into the new ADOM automatically.

NO.34 Refer to the exhibit. An administrator added a FortiGate device to FortiManager with the default object settings at the ADOM layer.

What can you conclude from the import policy package process of the HQ-NGFW- 1 device?

The administrator must select Per Platform for all interfaces to correctly detect all interfaces from HQ-NGFW-1.

The administrator must manually create the port4 interface on the ADOM layer to avoid import policy errors.

FortiManager will create LAN, port4, and port6 as normalized interfaces at the ADOM layer.

FortiGate may not work as expected when the administrator does not import all objects.

NO.35 Refer to the exhibits. An administrator ran the Install Wizard and selected to install both the policy package and device settings.
Why can the administrator not install the policy package on HQ-NGFW-1?

The administrator must change the Install on column from Installation Targets to HQ-NGFW-1.

The administrator must replace the interface Port6 with port6.

The administrator must use the admin user to install the policy package.

The administrator must remove the policy block assigned to HQ-NFFW-1.

NO.36 What is the best explanation of how FortiManager helps with mass provisioning?

It upgrades the OS of each FortiGate device.

It provides local FortiGuard Distribution Server (FDS) services to the network.

It uses templates to configure the same settings on many devices simultaneously.

It sends email alerts when new devices connect.

NO.37 If one of the secondary FortiManager devices fails, which action must be performed to return the FortiManager HA manual mode to a working state?

The FortiManager high availability (HA) state transition is transparent to administrators and does not require any reconfiguration.

Run a sanity check on the failed device to make sure HA heartbeat packets are using TCP port
5199.

Manually promote one of the working secondary devices to the primary role.

Remove the peer IP of the failed device on the primary device.