FCP — FortiManager 7.4 Administrator practice questions

1. Question 1 of 25

   What will be the result of reverting to a previous revision version in the revision history?

   • AIt will install configuration changes to managed device automatically.
   • BIt will tag the device settings status as Auto-Update.
   • CIt will modify the device-level database.
   • DIt will generate a new version ID and remove all other revision history versions.

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   A is false cuz this is the install wizard or quick install purpose B is false cuz auto-update is made by settings changed directly on managed device D is definitely not correct

   Adapted from community discussion by LAFNELL · 2024-11-10 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion1

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

   1. L

      LAFNELL

      2024-11-10

      Selected C2 upvotes

      A is false cuz this is the install wizard or quick install purpose B is false cuz auto-update is made by settings changed directly on managed device D is definitely not correct

2. Question 2 of 25

   An administrator wants to create a policy on an ADOM that is in backup mode and install it on a FortiGate device in the same ADOM. How can the administrator perform this task?

   • AThe administrator must use the Policy & Objects section to create a policy first.
   • BThe administrator must use a FortiManager script.
   • CThe administrator must disable the FortiManager offline mode first.
   • DThe administrator must change the ADOM mode to Advanced to bring the FortiManager online.

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   A is false, as no conf changes possible using policy package panel when in backup mode C is false, as there is no relationship between offline mode and this case D is false as no relationship here too

   Adapted from community discussion by LAFNELL · 2024-11-10 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

   1. D

      darco

      2025-03-13

      Selected B1 upvote

      The official documentation of FortiManager indicates that when an ADOM is in backup mode (offline mode), you cannot use the regular "Policy & Objects" + "Install Wizard" workflow to apply changes to FortiGate. The only way to push configurations to devices is through scripts. This includes, among other things, creating or modifying firewall rules (policies) directly in the CLI of the managed FortiGate. How is this actually done with a script? A script in FortiManager can contain CLI commands that will execute on the FortiGate, for example: config firewall policy edit 100 set name "Mi-Policy-desde-Script" set srcintf "port1" set dstintf "port2" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ALL" next end When running this script from FortiManager (even with the ADOM in backup mode) against the FortiGate, the policy is effectively created on the device. It is not the usual "graphical" procedure (you won't see it in the ADOM's "offline" policy database), but in practice you are installing (or modifying) a policy on the FortiGate.

   2. L

      LAFNELL

      2024-11-10

      Selected B4 upvotes

      A is false, as no conf changes possible using policy package panel when in backup mode C is false, as there is no relationship between offline mode and this case D is false as no relationship here too

   3. P

      pfeast420

      2025-01-29

      Selected B2 upvotes

      "To make configuration changes from FortiManager to managed devices while in backup mode, you must use the script feature." - page 43 of FMG study guide

   4. B

      BIGFATNUTS

      2024-10-23

      3 upvotes

      Wrong. Only scripts can be used in backup mode. Configuration changes are disabled.

3. Question 3 of 25

   Select 2

   Refer to the exhibit.

   

   You are using the Quick Install option to install configuration changes on the managed FortiGate. Which two statements correctly describe the result? (Choose two.)

   • AIt installs provisioning template changes on the FortiGate device.
   • BIt provides the option to preview only the policy package changes before installing them.
   • CIt installs all the changes in the device database first and the administrator must reinstall the changes on the FortiGate device.
   • DIt installs device-level changes on the FortiGate device without launching the Install Wizard.

   Show answer

   Correct answer: A, D

   How others answered

   • AD89%

   Explanation

   A&D are correct B&C are false, With Quick install no preview before the installation of changes, nothing to do on the managed device

   Adapted from community discussion by LAFNELL · 2024-11-10 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion3

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

   1. L

      LAFNELL

      2024-11-10

      Selected A, D3 upvotes

      A&D are correct B&C are false, With Quick install no preview before the installation of changes, nothing to do on the managed device

   2. D

      dadolphe

      2024-10-27

      Selected A, D2 upvotes

      I think it's AD, there is no need to reinstall after a quick install.

   3. B

      Beng_Beng

      2025-03-02

      1 upvote

      I see nothing in that link or anywhere in guide that will make C correct. No need to reinstall changes after quick install.

4. Question 4 of 25

   Refer to the exhibit.

   

   What percent of the available RAM is being used by the process in charge of downloading the web and email filter databases from the public FortiGuard servers?

   • A2.9
   • B3.1
   • C1.5
   • D4.1

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   The fgdlinkd process on FortiManager is responsible for downloading web-filter and email-filter databases from public FortiGuard servers, providing up-to-date security threat protection

   Adapted from community discussion by e7f2ce0 · 2024-11-07 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion3

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

   1. L

      LAFNELL

      2024-11-10

      Selected A4 upvotes

      fgdlinkd is the process responsible for downloading wf and email filter db

   2. E

      e7f2ce0

      2024-11-07

      Selected A3 upvotes

      The fgdlinkd process on FortiManager is responsible for downloading web-filter and email-filter databases from public FortiGuard servers, providing up-to-date security threat protection

   3. 8

      8795121

      2025-02-25

      Selected A1 upvote

      The fgdlinkd process on FortiManager downloads email-filter and web-filter databases from FortiGuard servers. This process helps keep security systems up to date.

5. Question 5 of 25

   Select 2

   Refer to the exhibit.

   

   Which two results occur if the script is run using the Device Database option? (Choose two.)

   • AYou must install these changes on a managed device using the Install Wizard.
   • BThe successful execution of a script on the Device Database creates a new revision history.
   • CThe script history shows successful installation of the script on the remote FortiGate device.
   • DThe device Config Status is tagged as Modified.

   Show answer

   Correct answer: A, D

   How others answered

   • AD100%

   Explanation

   A is correct, as the script is installed on device db, and not directly on the fortigate CLI D is correct, the device config will show status modified like whenever you do some changes using fortimanager and you don t install them.

   Adapted from community discussion by LAFNELL · 2024-11-10 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion2

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

   1. L

      LAFNELL

      2024-11-10

      Selected A, D4 upvotes

      A is correct, as the script is installed on device db, and not directly on the fortigate CLI D is correct, the device config will show status modified like whenever you do some changes using fortimanager and you don t install them.

   2. C

      Collins

      2024-11-13

      2 upvotes

      Once scripts are run on the device database, you can then install the changes on a managed device using the installation wizard. Since the script changed the device settings in FortiManager, the Config Status shows "Modified" and needs to be installed with Installation Wizard.

6. Question 6 of 25

   An administrator configures a new OSPF area on FortiManager and has not yet pushed the changes to the managed FortiGate device. In which database will the configuration be saved?

   • ADevice-level database
   • BADOM-level database
   • CConfiguration-level database
   • DRevision history database

   Show answer

   Correct answer: A

   How others answered

   • A78%
   • B22%

   Explanation

   OSPF configurations are made on device-level database. Be sure to activate the feature visibility in device & groups menu. A is the correct answer

   Adapted from community discussion by LAFNELL · 2024-11-10 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion3

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

   1. L

      LAFNELL

      2024-11-10

      Selected A4 upvotes

      OSPF configurations are made on device-level database. Be sure to activate the feature visibility in device & groups menu. A is the correct answer

   2. T

      TigerL

      2024-11-12

      Selected A3 upvotes

      OSPF configurations are made on device-level database. Be sure to activate the feature visibility in device & groups menu.

   3. L

      LAFNELL

      2024-11-10

      3 upvotes

      Moderator, don t approve this answer sorry it s not correct. A is the correct one

7. Question 7 of 25

   Select 2

   An administrator created a new global policy package that includes header and footer policies and then assigned it to an ADOM. What are two outcomes of this action? (Choose two.)

   • ATo assign another global policy package later to the same ADOM, you must unassign this policy first.
   • BAfter you assign the global policy package to an ADOM. the impacted policy packages become hidden in that ADOM.
   • CYou can editor delete all the global objects in the global ADOM.
   • DYou must manually move the header and footer policies after the policy assignment.

   Show answer

   Correct answer: A, C

   How others answered

   • AC100%

   Explanation

   i go for A and C because i am sure B and D are false. but there is something weird on FMG you can assign two differents global policy package to the same ADOM at same time but on different policy package in that ADOM. No need to unassign one of them first. But you cannot assign a new global policy package to the "same policy" in an ADOM without unassign first the other one already assigned.

   Adapted from community discussion by LAFNELL · 2024-11-10 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion1

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

   1. L

      LAFNELL

      2024-11-10

      Selected A, C2 upvotes

      i go for A and C because i am sure B and D are false. but there is something weird on FMG you can assign two differents global policy package to the same ADOM at same time but on different policy package in that ADOM. No need to unassign one of them first. But you cannot assign a new global policy package to the "same policy" in an ADOM without unassign first the other one already assigned.

8. Question 8 of 25

   What must you consider before deciding to use FortiManager to manage a FortiAnalyzer device?

   • AConfirm that FortiManager has enough storage capacity for the expected logs.
   • BEnsure that FortiAnalyzer features are installed in advance.
   • CCheck whether FortiManager is part of a high availability (HA) cluster.
   • DDetermine whether the VDOMs of the same FortiGate will be assigned to different ADOMs.

   Show answer

   Correct answer: D

   How others answered

   • D64%
   • C36%

   Only 64% agreed on this answer — treat it as contested rather than settled.

   Explanation

   D is correct. When FMG is managing a FAZ, you cannot switch to advanced mode. And it s only in advanced mode Vdoms of the same Fortigate can be assigned to differents ADOM

   Adapted from community discussion by LAFNELL · 2024-11-10 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

   1. L

      LAFNELL

      2024-11-10

      Selected D6 upvotes

      D is correct. When FMG is managing a FAZ, you cannot switch to advanced mode. And it s only in advanced mode Vdoms of the same Fortigate can be assigned to differents ADOM

   2. S

      sxcap

      2025-01-08

      Selected D1 upvote

      The correct answer is D: Determine whether the VDOMs of the same FortiGate will be assigned to different ADOMs. This is important because: When using FortiManager to manage FortiAnalyzer, you must ensure proper ADOM (Administrative Domain) configuration, particularly when dealing with FortiGate VDOMs (Virtual Domains). All VDOMs from the same FortiGate device must be assigned to the same ADOM in FortiAnalyzer. This is a strict requirement that cannot be circumvented.

   3. A

      aa0v1snjr9

      2024-11-10

      1 upvote

      I don't found any correct response. A Wrong because the logs kept on the FAZ B Wrong because if FMG manage FAZ is not need enable FAZ feature C should be wrong because i don't find anything about it D wrong because it's not relevant about question

   4. L

      LAFNELL

      2024-11-16

      1 upvote

      D is completely relevant, PAY ATTENTION. if different VDOMs of the same Fortigate will be managed in different ADOM, FMG should be configure in advanced mode. But if you manage a Fortianalyzer, you cannot configure FMG in Advanced Mode.

9. Question 9 of 25

   An administrator is in the process of copying a system template profile between ADOMs by running the following command: execute fmprofile import-profile ADOM2 3547 /tmp/myfile Where does this command import the system template profile from?

   • AFortiManager file system
   • BADOM2 object database
   • CADOM2 device database
   • DSource ADOM policy database

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   Answer is A. From user Satekhi under the NSE5_FMG-7.2 topic, same question: "The command in question is execute fmprofile import-profile ADOM2 3547 /tmp/myfile. If the administrator is importing the system template profile into ADOM2, and considering each ADOM has a unique object database, the file is likely being imported from the FortiManager file system. ~ FMG 7.2 p109"

   Adapted from community discussion by InvOpinion · 2024-12-04 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion1

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

   1. I

      InvOpinion

      2024-12-04

      Selected A2 upvotes

      Answer is A. From user Satekhi under the NSE5_FMG-7.2 topic, same question: "The command in question is execute fmprofile import-profile ADOM2 3547 /tmp/myfile. If the administrator is importing the system template profile into ADOM2, and considering each ADOM has a unique object database, the file is likely being imported from the FortiManager file system. ~ FMG 7.2 p109"

10. Question 10 of 25

    An administrator has assigned a global policy package to a new ADOM called ADOM1. What will happen if the administrator tries to create a new policy package in ADOM1?

    • AWhen creating a new policy package, the administrator can select the option to assign the global policy package to the new policy package.
    • BWhen a new policy package is created, the administrator must assign the global policy package from the global ADOM.
    • CWhen a new policy package is created, the administrator must import the global policy package to ADOM1.
    • DWhen the new policy package is created, FortiManager automatically assigns the global policy package to the new policy package.

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    I will go for D Supposing when the global pp is assigned to ADOM, the default option assign to all PP in the ADOM is let checked.

    Adapted from community discussion by LAFNELL · 2024-11-10 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

    1. L

       LAFNELL

       2024-11-10

       Selected D2 upvotes

       I will go for D Supposing when the global pp is assigned to ADOM, the default option assign to all PP in the ADOM is let checked.

    2. S

       SingSingHK

       2024-12-29

       Selected D1 upvote

       first, this answer conflict with another question earlier. and I just performed a quick lab, it will automatically added to new policy package. (in fact, also auto added to existing policy package as well)

11. Question 11 of 25

    Refer to the exhibit.

    

    An administrator has created a firewall address object that is used in multiple policy packages for multiple FortiGate devices in an ADOM. After the installation operation is performed, which IP/netmask is shown on FortiManager for this firewall address object for devices without a Per-Device Mapping set?

    • AFortiManager generates an error for each FortiGate without a per-device mapping defined for that object.
    • B192.168.1.0/24
    • C192.168.1.0/28
    • DFortiManager replaces the address object to none.

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    A is false C is false, that s the value only for Local-Fortigate which has a per-device mapping D is false because the none object is used in the case where Fortimanager installs on a device an object which has been previously deleted answer is B

    Adapted from community discussion by LAFNELL · 2024-11-09 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

    1. L

       LAFNELL

       2024-11-09

       Selected B3 upvotes

       A is false C is false, that s the value only for Local-Fortigate which has a per-device mapping D is false because the none object is used in the case where Fortimanager installs on a device an object which has been previously deleted answer is B

    2. C

       Collins

       2024-11-12

       2 upvotes

       B. FortiManager installs the default value if there is no reference.

    3. Y

       Ygrec

       2024-11-03

       1 upvote

       Anyone please to share ? I don't understand that one and the answer

12. Question 12 of 25

    Select 2

    What are two outcomes of ADOM revisions? (Choose two.)

    • AADOM revisions can create System Checkpoints for the FortiManager configuration.
    • BADOM revisions can save the current state of the whole ADOM.
    • CADOM revisions can significantly increase the size of the configuration backups.
    • DADOM revisions can save the current state of all policy packages and objects for an ADOM.

    Show answer

    Correct answer: C, D

    How others answered

    • CD100%

    Explanation

    C & D are the correct answers A & B are not correct, cuz ADOM revisions are not linked to FMG configuration, and does not contain ADOM settings

    Adapted from community discussion by LAFNELL · 2024-11-10 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

    1. S

       Shashanka

       2024-12-03

       Selected C, D2 upvotes

       Correct Answer: C & D. FortiManager 7.4 Administrator Study Guide - Page No:199.

    2. D

       dadolphe

       2024-10-28

       Selected C, D1 upvote

       "It is possible to keep a revision history of changes made at the policy and objects level. However, unlike at the device level, the revision history at this level can significantly increase the overall size of your configuration backup." - FortiManager 7.2.0 Best Practices p18

    3. L

       LAFNELL

       2024-11-10

       2 upvotes

       C & D are the correct answers A & B are not correct, cuz ADOM revisions are not linked to FMG configuration, and does not contain ADOM settings

13. Question 13 of 25

    Refer to the exhibit.

    

    Which statement about the environment shown in the exhibit is correct?

    • AYou must restart the secondary unit if you promote it to become the primary.
    • BA failover will take place after five minutes without receiving heartbeat packets.
    • CFortiAnalyzer features are not enabled on this FortiManager device.
    • DNo FortiGuard packages have been synchronized between the cluster members yet.

    Show answer

    Correct answer: C

    How others answered

    • C89%

    Explanation

    FortiManager 7.4 Administrator Study Guide page 11 lf FortiAnalyzer features are enabled, you cannot add FortiAnalyzer to FortiManager. You will also not be able to configure FortiManager high availability (HA)

    Adapted from community discussion by eamstar · 2024-11-05 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

    1. E

       eamstar

       2024-11-05

       Selected C4 upvotes

       FortiManager 7.4 Administrator Study Guide page 11 lf FortiAnalyzer features are enabled, you cannot add FortiAnalyzer to FortiManager. You will also not be able to configure FortiManager high availability (HA)

    2. Y

       yo86

       2025-03-25

       Selected C1 upvote

       Correct Answer: C Study guide page 293 A is incorrect : Study guide page 293 "Don't need to reboot devices when promoting from secondary to primary" B is incorrect : Study guide page 293 "When the monitored interface for the primary is down, HA failover will occur automatically" D is incorrect : Study guide page 292 "FortiGuard Antivirus/IPSpackages, webfilter, antispam databases are not synchronized"

    3. L

       LAFNELL

       2024-11-11

       Selected C2 upvotes

       Correct answer is C, as HA cannot be configured with Fortianalyzer Features enabled on FMG

    4. L

       LAFNELL

       2024-11-11

       2 upvotes

       incorrect, cuz Failover mode is set to manual on the exhibit

14. Question 14 of 25

    An administrator created a new ADOM named Training for FortiGate devices only, and added the root FortiGate device of a Security Fabric group to the Training ADOM. Given the administrator's actions, which statement correctly describes the expected result for the downstream devices in the Security Fabric?

    • AThe downstream devices show as unauthorized in the Training ADOM.
    • BThe downstream devices are automatically authorized.
    • CThe downstream devices will appear in the root ADOM.
    • DThe downstream devices must be added using the Add Device wizard.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    correct answer is A, as the root fortigate is already added in Training ADOM. All downstream fortigate in the sec fabric group will be added in unauthorized devices group in the same ADOM as the root.

    Adapted from community discussion by LAFNELL · 2024-11-11 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

    1. L

       LAFNELL

       2024-11-11

       Selected A3 upvotes

       correct answer is A, as the root fortigate is already added in Training ADOM. All downstream fortigate in the sec fabric group will be added in unauthorized devices group in the same ADOM as the root.

    2. F

       ferrogiuse88

       2025-02-06

       1 upvote

       C. The downstream devices will appear as unauthorized devices in the root ADOM

15. Question 15 of 25

    Select 2

    Which two statements about the integrity of databases on FortiManager are correct? (Choose two.)

    • AThe diagnose dvm check-integrity command attempts to fix a corrupted file system.
    • BScheduled backups run database integrity commands automatically.
    • CNot following the correct upgrade path may cause inconsistencies in the databases.
    • DYou should fix all database integrity issues before performing a backup.
    • EThe diagnose cdb check adom-integrity command can correct issues related to looked devices.

    Show answer

    Correct answer: B, C

    How others answered

    • BC100%

    Explanation

    B: it's OK from study guide p261: FortiManager automatically runs database integrity commands prior to a schedule backup and creates logs C: it' OK from study guide p260: Always follow the correct upgrade path. If you don’t, it may cause inconsistencies in the databas D: it's wrong. from study guide p261: It is recommended that you perform a backup before executing database integrity commands.

    Adapted from community discussion by aa0v1snjr9 · 2024-11-11 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

    1. A

       aa0v1snjr9

       2024-11-11

       3 upvotes

       B: it's OK from study guide p261: FortiManager automatically runs database integrity commands prior to a schedule backup and creates logs C: it' OK from study guide p260: Always follow the correct upgrade path. If you don’t, it may cause inconsistencies in the databas D: it's wrong. from study guide p261: It is recommended that you perform a backup before executing database integrity commands.

    2. T

       truserud

       2025-02-16

       Selected B, C1 upvote

       B&C: B: Scheduled backups perform database integrity commands prior to a scheduled backup, and creates logs - page 261 in the Study Guide C: Not following the correct upgrade patch can cause inconsistencies in the database. Page 260 in the study guide.

    3. L

       LAFNELL

       2024-11-11

       Selected B, C1 upvote

       For sure 100% A&E are incorrect B is correct Have a doubt about C&D, but will go for C correct as it s recommended to perform a Backup before launching database integrity check, which is supposed to fix issues

16. Question 16 of 25

    Select 2

    If both FortiManager and FortiGate are behind NAT devices, what are the two expected results? (Choose two.)

    • AFortiGate is discovered by FortiManager through the FortiGate NATed IP address.
    • BFortiGate can announce itself to FortiManager only if the FortiManager non-NATed IP address is configured on FortiGate under central management.
    • CIf the FGFM tunnel is torn down, FortiManager will try to re-establish the FGFM tunnel.
    • DDuring discovery, the FortiManager NATed IP address is not set by default on FortiGate.

    Show answer

    Correct answer: A, D

    How others answered

    • AD100%

    Explanation

    A&D are correct answers B is incorrect. Fortigate can announce itself to FMG in the case FMG Nated IP address is configured under central management C is incorrect, as in this scenario only Fortigate can try to reestablish the FGFM tunnel when it s torn down. FYI D is correct because of "by default". During discovery process, FMG Nated IP address is set on FGT only if in the FMG admin setting Nated ip address has been specify like mgmt address. FMG Administrator Study Guide

    Adapted from community discussion by LAFNELL · 2024-11-11 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

    1. L

       LAFNELL

       2024-11-11

       Selected A, D3 upvotes

       A&D are correct answers B is incorrect. Fortigate can announce itself to FMG in the case FMG Nated IP address is configured under central management C is incorrect, as in this scenario only Fortigate can try to reestablish the FGFM tunnel when it s torn down. FYI D is correct because of "by default". During discovery process, FMG Nated IP address is set on FGT only if in the FMG admin setting Nated ip address has been specify like mgmt address. FMG Administrator Study Guide

    2. 7

       79fad4e

       2024-11-09

       1 upvote

       B&D Fortimanager can discover FortiGate through a NATed FortiGate IP address. If a FortiManager NATed IP address is configured on FortiGate, then FortiGate can announce itself to FortiManager. FortiManager will not attempt to re-establish the FGFM tunnel to the FortiGate NATed IP address, if the FGFM tunnel is interrupted. Just like it was in the NATed FortiManager scenario, the FortiManager NATed IP address in this scenario is not configured under FortiGate central management configuration.

17. Question 17 of 25

    Select 2

    Refer to the exhibit.

    

    Which two statements about the output are true? (Choose two.)

    • AThe latest revision history for the managed FortiGate does not match the device-level database.
    • BConfiguration changes have been installed on FortiGate, which means the FortiGate configuration has been changed.
    • CConfiguration changes directly made on FortiGate have been automatically updated to the device-level database.
    • DThe latest revision history for the managed FortiGate does match the FortiGate running configuration.

    Show answer

    Correct answer: A, D

    How others answered

    • AD70%
    • AB30%

    Only 70% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A&D are correct. – conf: in sync – This is the sync status which shows that the latest revision history is in sync with Fortigate’s configuration. - There is a new modification on FortiManager device level DB (dev-db: modified) which wasn’t installed to FortiGate (cond: pending)

    Adapted from community discussion by Shashanka · 2024-10-23 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

    1. S

       Shashanka

       2024-10-23

       5 upvotes

       A&D are correct. – conf: in sync – This is the sync status which shows that the latest revision history is in sync with Fortigate’s configuration. - There is a new modification on FortiManager device level DB (dev-db: modified) which wasn’t installed to FortiGate (cond: pending)

    2. L

       LAFNELL

       2024-11-10

       3 upvotes

       B is false cause dev-db is modified so configurations changes have not been installed C is false cause dm is retrieved and not auto-updated A&D are correct

    3. L

       lmptcne

       2024-11-18

       2 upvotes

       you're right, after reading it again I realized that... A&D are correct!

    4. L

       LAFNELL

       2024-11-16

       1 upvote

       No dev-db: modified, means modifications have been done on device level directly on Fortimanager, but not yet installed on managed device.

18. Question 18 of 25

    You are moving managed FortiGate devices from one ADOM to a new ADOM. Which statement correctly describes the expected result?

    • AThe shared device settings will be installed automatically.
    • BThe shared policy package will not be moved to the new ADOM automatically.
    • CAny unused objects from a previous ADOM are moved to the new ADOM automatically.
    • DPolicy packages will be imported into the new ADOM automatically.

    Show answer

    Correct answer: B

    How others answered

    • B83%
    • C17%

    Explanation

    B it's correct From study Guide : When you move devices from one ADOM to another ADOM, shared policy packages and objects do not move to the new ADOM. You will need to import policy packages from managed devices

    Adapted from community discussion by aa0v1snjr9 · 2024-11-12 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

    1. A

       aa0v1snjr9

       2024-11-12

       4 upvotes

       B it's correct From study Guide : When you move devices from one ADOM to another ADOM, shared policy packages and objects do not move to the new ADOM. You will need to import policy packages from managed devices

    2. S

       sxcap

       2025-01-08

       Selected B1 upvote

       When you move a managed FortiGate device from one ADOM to another in FortiManager, the configuration is not transferred automatically. Specifically: Policy Packages: Policy packages associated with the FortiGate in the old ADOM are not automatically moved or imported into the new ADOM. You need to manually re-create or import them in the new ADOM. Shared Device Settings: These settings are not automatically installed in the new ADOM. Unused Objects: Unused objects from the previous ADOM are not moved automatically. This behavior ensures that administrators can manage and review configurations explicitly when transitioning devices between ADOMs to avoid unintended configuration mismatches or conflicts.

19. Question 19 of 25

    Refer to the exhibit.

    

    In the event that the monitored interface for the primary FortiManager device fails, which action must you perform to return FortiManager high availability (HA) to a working state?

    • AManually promote one of the working secondary devices to the primary role, and reboot the old primary device to remove the peer IP address of the failed device.
    • BReboot the current primary device to force a secondary device to become the new primary.
    • CThe FortiManager HA failover is transparent to administrators and does not require any additional action.
    • DReconfigure the primary device to remove the peer IP address of the failed device from its configuration.

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    C is correct. No action is required because of VRRP activated on the HA configuration. The Failover will occur automatically once the monitored interface is lost. FMG 7.4 Administrator Study Guide

    Adapted from community discussion by LAFNELL · 2024-11-11 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion1

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

    1. L

       LAFNELL

       2024-11-11

       Selected C3 upvotes

       C is correct. No action is required because of VRRP activated on the HA configuration. The Failover will occur automatically once the monitored interface is lost. FMG 7.4 Administrator Study Guide

20. Question 20 of 25

    Refer to the exhibit.

    

    An administrator is importing a new device into FortiManager and has selected the options shown in the exhibit. What will happen if the administrator makes changes and then installs the modified policy package on this managed FortiGate?

    • APolicies not imported prompt a confirmation before being deleted.
    • BPolicies not imported are marked as modified for future import attempts.
    • CPolicies not imported remain untouched on the managed FortiGate.
    • DPolicies not imported are deleted on the managed FortiGate during the installation.

    Show answer

    Correct answer: D

    How others answered

    • D80%
    • C20%

    Explanation

    Correct Answer: D. The wizard performs a policy search to find all policies in preparation for import into the FortiManager database. You may choose to import all firewall policies, or select specific policies to import. If you choose to import only specific policies into the policy package and later install policy changes, the policies that were not imported will be deleted locally on FortiGate. This is because FortiManager does not have those policies in the policy package. - FortiManager 7.4 Administrator Study Guide - Page No:190

    Adapted from community discussion by Shashanka · 2024-12-12 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

    1. S

       Shashanka

       2024-12-12

       Selected D2 upvotes

       Correct Answer: D. The wizard performs a policy search to find all policies in preparation for import into the FortiManager database. You may choose to import all firewall policies, or select specific policies to import. If you choose to import only specific policies into the policy package and later install policy changes, the policies that were not imported will be deleted locally on FortiGate. This is because FortiManager does not have those policies in the policy package. - FortiManager 7.4 Administrator Study Guide - Page No:190

    2. L

       LAFNELL

       2024-11-11

       1 upvote

       Sorry Answer is D as well, as they specified in the quesiton policy is installed on the managed device

21. Question 21 of 25

    Refer to the exhibit.

    

    How will FortiManager try to get updates tor antivirus and IPS?

    • AFrom the list of configured override servers or public FDN servers
    • BFrom the configured override server IP address 10.0.1.50 only
    • CFrom the default server fds1.fortinet.com
    • DFrom public FDNI server IP address with the fourth highest octet only

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    As the server override mode is strict, there is no fallback. FMG will communicate only with server configure in override server list.

    Adapted from community discussion by LAFNELL · 2024-11-11 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion1

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

    1. L

       LAFNELL

       2024-11-11

       Selected B6 upvotes

       As the server override mode is strict, there is no fallback. FMG will communicate only with server configure in override server list.

22. Question 22 of 25

    An administrator, Trainer, who is assigned the Super_User profile, is trying to approve a workflow session that was submitted by another administrator, Student. However, Trainer is unable to approve the workflow session. What can prevent an admin account that has Super_User rights over the device from approving a workflow session?

    • ATrainer is not a part of workflow approval group.
    • BTrainer must close Student's workflow session before approving the request.
    • CTrainer must first create their own workflow session to approve student session.
    • DTrainer does not have full rights over this ADOM.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    A is correct. having super_role is not sufficient to approve changes made by other administrator. The administrator should have been added to approval group.

    Adapted from community discussion by LAFNELL · 2024-11-11 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

    1. L

       LAFNELL

       2024-11-11

       Selected A4 upvotes

       A is correct. having super_role is not sufficient to approve changes made by other administrator. The administrator should have been added to approval group.

    2. S

       Shashanka

       2024-12-12

       Selected A3 upvotes

       Correct Answer: A FortiManager 7.4 Administrator Study Guide - Page No:210

    3. R

       Rob4789963

       2024-11-17

       2 upvotes

       A An administrator must be part of an approval group, and have rights over the ADOM in which the session was created. Page 210 Study guide

    4. A

       abirafiqa

       2024-11-14

       2 upvotes

       A An administrator must be part of an approval group regardless of whcih admin profile an administrator account is part of

23. Question 23 of 25

    Which statement about the policy lock feature on FortiManager is true?

    • APolicy locking is available in workspace normal mode.
    • BLocking a policy takes precedence over a locked ADOM.
    • CWhen a policy is locked, the ADOM that contains it is also locked.
    • DAdministrators in the approval group can work concurrently on a locked policy.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    If you want to modify a policy, you don't need to lock the entire policy package. Once you lock a policy, a padlock icon appears beside the policy. Others are now unable to modify your policy or lock the policy package where the locked policy is in, and unable to lock the ADOM.

    Adapted from community discussion by MaDeInBe · 2024-10-31 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

    1. M

       MaDeInBe

       2024-10-31

       Selected A2 upvotes

       If you want to modify a policy, you don't need to lock the entire policy package. Once you lock a policy, a padlock icon appears beside the policy. Others are now unable to modify your policy or lock the policy package where the locked policy is in, and unable to lock the ADOM.

    2. S

       Shashanka

       2024-10-23

       3 upvotes

       Option A is the correct answer. Ref: FortiManager_7.4_Administrator_Study_Guide-Online - page-205

24. Question 24 of 25

    Select 2

    Refer to the exhibit.

    

    An administrator would like to create three ADOMs on FortiManager with different access levels based on departments. What two conclusions can you draw from the design shown in the exhibit? (Choose two.)

    • AThe FortiManager administrator must set the ADOM device mode to Advanced.
    • BPolicies and objects databases can be shared between the Financial and HR ADOMs.
    • CAn administrator with the super user profile can access all the VDOMs.
    • DThe administrator must configure FortiManager in workspace normal mode.

    Show answer

    Correct answer: A, C

    How others answered

    • AC100%

    Explanation

    A is obviously required to split VDOMs over several ADOMs B is not true D is not asked (locking ADOM etc is not required) so C is the other valid reply

    Adapted from community discussion by MaDeInBe · 2024-10-31 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

    1. M

       MaDeInBe

       2024-10-31

       Selected A, C3 upvotes

       A is obviously required to split VDOMs over several ADOMs B is not true D is not asked (locking ADOM etc is not required) so C is the other valid reply

    2. L

       LAFNELL

       2024-11-10

       Selected A, C3 upvotes

       Correct answer A&C A is mandatory C is 100% true D is not necessary for this question B is false

    3. F

       flamengo

       2024-11-15

       2 upvotes

       Answers A and C page 9 - FortiManager_7.4_Administrator_Study_Guide

25. Question 25 of 25

    Select 2

    Which two items does an FGFM keepalive message include? (Choose two.)

    • AFortiGate IPS version
    • BFortiGate license information
    • CFortiGate configuration checksum
    • DFortiGate uptime

    Show answer

    Correct answer: A, C

    How others answered

    • AC100%

    Explanation

    You are right ! "The keep-alive message contains information that assists the FortiManager in managing the FortiGate unit, such as current OS version, platform, configuration checksum and versions of the unit’s AV and IPS databases." - Communications Protocol Guide FortiGate / FortiManager 7.4 page 6.

    Adapted from community discussion by dadolphe · 2024-10-27 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by FCP_FMG_AD-7.4 or CertExamHQ.

    1. B

       BIGFATNUTS

       2024-10-23

       Selected A, C3 upvotes

       Wrong. There is no uptime involved. Only IPS version and checksum.

    2. D

       dadolphe

       2024-10-27

       2 upvotes

       You are right ! "The keep-alive message contains information that assists the FortiManager in managing the FortiGate unit, such as current OS version, platform, configuration checksum and versions of the unit’s AV and IPS databases." - Communications Protocol Guide FortiGate / FortiManager 7.4 page 6.

    3. L

       LAFNELL

       2024-11-10

       Selected A, C2 upvotes

       A&C correct answers FMG Fortigates send keepalive messages, which content IPS version and checksum

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCP_FMG_AD-7.4 practice, question 1 of 25