Free Fortinet FCP_FMG_AD-7.4 Practice Exam with Questions & Answers | Set: 2

Based on the exhibit, the FortiManager administrator is setting up three ADOMs (Administrative Domains) that correspond to different departments (Financial, HR, and IT). Each ADOM has specific FortiGate devices or VDOMs (Virtual Domains) assigned to it, with different administrators managing the ADOMs.

Explanation of Options:

A. The FortiManager administrator must set the ADOM device mode to Advanced.

This istrue. In FortiManager, when there areVDOMs(Virtual Domains) involved, you must set the ADOM toAdvanced modeto manage VDOMs properly. The IT department ADOM includes different VDOMs from FortiGate 4 (VDOM 2 and VDOM 3), which means the ADOM mode must be inAdvancedto support managing VDOMs separately from other ADOMs.

B. Policies and objects databases can be shared between the Financial and HR ADOMs.

This isfalse. By default, ADOMs are separate, and policies and objects cannot be shared between them unless they are specifically designed to do so. The exhibit shows distinct ADOMs for each department, implying no direct sharing of policies and objects between Financial and HR ADOMs.

C. An administrator with the super user profile can access all the VDOMs.

This istrue. A FortiManager administrator with thesuper userprofile hasfull accessto all ADOMs and VDOMs, regardless of how access is restricted for individual administrators. In this case, an admin with the super user profile could access Financial, HR, and IT ADOMs, including all the VDOMs from FortiGate 4.

D. The administrator must configure FortiManager in workspace normal mode.

This isfalse. There is no requirement mentioned in the exhibit or scenario that mandates usingworkspace normal mode. Workspace mode is more related to how configuration changes are managed (locking, editing, etc.), but it doesn’t affect the creation or access control of ADOMs.

Conclusion:

Ais correct becauseAdvanced modeis necessary for managing VDOMs within ADOMs.

Cis correct because asuper usercan access all VDOMs and ADOMs without restrictions.

Option B: Routingis the correct answer. The ADOM-level database in FortiManager stores configuration settings such as routing, firewall policies, and objects that are shared across multiple devices in the ADOM.

Explanation of Incorrect Options:

Option A: NSX-T Service Templateis incorrect as it is not a FortiGate-specific setting managed at the ADOM level.

Option C: SNMPis incorrect because SNMP settings are typically managed on a per-device basis.

Option D: Security profilesis incorrect because security profiles are generally device-level configurations, not ADOM-level.

FortiManager References:

Refer to "FortiManager Administration Guide" for further details on ADOM-level and device-level configurations.

Security profiles (such as antivirus, web filtering, application control, etc.) are stored in the ADOM-level database because they can be shared across multiple devices within the same ADOM.

The statement that is true about the policy lock feature on FortiManager is:

A. Policy locking is available in workspace normal mode.

In FortiManager, when working in "workspace-mode normal," policies can be locked by administrators to prevent other administrators from editing them simultaneously. This ensures that only one administrator makes changes at any given time, reducing conflicts or mistakes due to concurrent modifications.

Statements B, C, and D are incorrect because:

B is incorrect since locking a policy does not override a locked ADOM. The ADOM lock takes precedence.

C is incorrect because when a policy is locked, it does not necessarily mean the ADOM is locked.

D is incorrect because administrators in the approval group cannot work concurrently on a locked policy; the policy lock prevents concurrent modifications.

FortiManager References:

Refer to FortiManager 7.4 Administrator Guide: Policy and Objects > Policy Locking to understand how the policy lock feature functions in different workspace modes.

When a root FortiGate device is added to a specific ADOM (like Training), the downstream devices (those that are part of the Security Fabric) will not automatically be authorized in that ADOM. They will typically appear as unauthorized until explicitly authorized by an administrator.

The objects highlighted in the image (DMZ_SUBNET, ISP1_SUBNET, LAN_SUBNET) aremetadata variables.

C.They can be used as variables in scripts.

These metadata variables are placeholders that can be used in FortiManager scripts to dynamically insert specific values, enabling script flexibility and scalability across multiple devices or ADOMs.

Options A, B, and D are incorrect because:

Asuggests optional or required settings, which do not apply to metadata variables.

Bimplies they are available across all ADOMs by default, which is not always the case.

Dstates they cannot be created in the global database ADOM, but metadata variables are typically managed within ADOMs and can be utilized globally based on specific configurations.

FortiManager References:

Refer to FortiManager 7.4 Administrator Guide: Using Metadata Variables and Script Management.